The parts that make this work
RandomX proof of work
Since November 2019 (block 1,978,433) Monero has used RandomX. For each attempt the hash of the block header seeds a random program in a small virtual instruction set; the miner compiles it to native code and runs it, reading a 2 GB dataset that is rebuilt every 2,048 blocks. General-purpose CPUs with big caches are what this rewards, which keeps mining open to people with ordinary computers and keeps ASICs at a small advantage. The block is valid when the final hash, read as a number, times the difficulty fits under 2256. In late September 2026 the network makes about 6 billion RandomX hashes a second (6 GH/s) at a difficulty of about 717 billion.
Difficulty every block, and the heaviest chain
There is no two-week retarget. Every block, each node looks at the timestamps and cumulative difficulty of the last 720 blocks, drops the 60 earliest and 60 latest timestamps as outliers, ignores the newest 15 blocks, and sets the difficulty so blocks average 120 seconds. Nodes follow the chain with the highest cumulative difficulty, the sum of every block's difficulty, not simply the one with the most blocks. A block's timestamp must be later than the median of the previous 60 and no more than two hours in the future.
Stealth addresses
A Monero address never appears on chain. The sender combines the recipient's public view and spend keys with a fresh random number to derive a one-time public key for each output, and publishes a matching transaction public key. Only the recipient, scanning with their private view key, can recognise the output as theirs, and only their private spend key can spend it. Two payments to the same address look unrelated. Since 2022 a one-byte view tag lets wallets skip about 255 of every 256 outputs that aren't theirs without the full calculation.
Ring signatures and key images
Every input names a ring of 16 existing outputs: the real one and 15 decoys the wallet draws from a distribution that favours recent outputs, because real spends do. A CLSAG signature proves the signer holds the key for one of them without saying which. The signer must also publish a key image, a value computed from the real output's private key that is the same whichever ring it hides in. Nodes keep every key image ever seen and reject a transaction that repeats one, which is how double spends are stopped without knowing what was spent. Ring size 16 and CLSAG are the rules on mainnet today: the August 2022 upgrade (block 2,688,888) raised the ring from 11 to 16.
Hidden amounts: RingCT and Bulletproofs+
Amounts are Pedersen commitments, not numbers. Nodes check that the input commitments equal the output commitments plus the fee, which is the one amount in a transaction left in the clear, so no coins are created. Without more, someone could commit to a negative output and mint the difference, so each output carries a range proof that its amount is between 0 and 264. Bulletproofs+, live since August 2022, make that proof about 640 bytes for two outputs. The recipient learns the amount through an encrypted field only they can open.
Dandelion++ relay
On most networks the first node to announce a transaction is probably close to its sender. Since 2020 Monero nodes send their own transactions, and those they receive in the stem phase, to a single chosen peer. Each hop flips a weighted coin; after a few hops one node switches to fluff and broadcasts normally. If a stem stalls, a timer makes the node fluff it anyway, so transactions aren't lost. Running a node over Tor or I2P hides the origin further.
Tail emission and the block reward
The reward used to fall smoothly with each block. Once it reached 0.6 XMR, in June 2022 at block 2,641,623, it stopped falling: every block now pays exactly 0.6 XMR plus its fees, forever. That is 432 XMR a day, about 157,700 a year, or roughly 0.84 % of today's 18.8 million XMR supply and a shrinking share every year. The design keeps paying miners to secure the chain without relying on fees alone, and roughly offsets coins lost over time. Newly mined coins can't be spent for 60 blocks.
A block size that floats, with a penalty
There is no fixed block size limit. A block may be as large as the median weight of the last 100 blocks, or 300 kB if that median is smaller, without cost. Above it, the miner forfeits part of the reward: a block 1.5 times the median loses a quarter, and nothing can be more than twice the median. Forfeited coins are simply never created. A second, long-term median over 100,000 blocks caps how fast the short-term one can rise, so a burst of spam can't grow blocks quickly. Fees scale with the same medians: most wallets pay the lowest of four priority levels, today about 20,000 piconero per byte, around 0.00003 XMR for a normal two-output transfer.
Reorgs, Qubic and the 10-block lock
Finality is probabilistic, as on Bitcoin. In August and September 2025 the Qubic pool, with roughly a quarter to a third of the hashrate, withheld blocks and released them in runs, causing reorganisations up to 18 blocks deep. Many exchanges wait for 10 or more confirmations, matching the protocol rule that a received output can't be spent until it is 10 blocks deep. Most honest hashrate is split between public pools and P2Pool, a decentralised pool whose own side chain pays miners directly in the coinbase.
What hasn't launched: FCMP++
Full-chain membership proofs (FCMP++) would replace the 16-member ring with a proof that the input is one of every output on the chain, and the Carrot address scheme would come with them. As of 1 October 2026 they run only on a public test network (a beta stressnet fork is set for 5 October); mainnet is still on hard fork version 16, with CLSAG and rings of 16, and no activation height has been set. This page shows what mainnet runs today.
What live mode shows
Live mode polls the public API of the xmrchain.net explorer every few seconds. Every violet dot is a real transaction in its node's mempool, with size and fee in the feed. Each new block's height, hash, transaction count, size, fees and reward are real, and the ring chart decodes a real transaction from it. Mining pools aren't named because Monero blocks don't name them, so the flash on the inner ring is placed arbitrarily, and the full-node ring and propagation wave are drawn, not measured. If xmrchain.net is unreachable, blocks come from moneroblocks.info instead, without the mempool.
What the animation simplifies
Time is compressed about thirteen-fold: a two-minute block takes about nine seconds at 1×. Real stems are longer and run in parallel, verification happens as each transaction and block arrives, and miners never stop hashing. The step-by-step miners, their shares, the decoys drawn in the scene and the transaction counts are illustrative, and stale blocks and double-spend attempts are staged far more often than mainnet sees them. Read Moneropedia, the RandomX design notes, Zero to Monero and the consensus constants for the full protocol.