Confidential Transaction

What Is a Confidential Transaction?

A confidential transaction (CT) is a blockchain transaction where the amounts being transferred are cryptographically hidden from everyone except the sender and receiver. Validators can still verify that no coins were created or destroyed: the math proves that the sum of inputs equals the sum of outputs, without revealing any individual value.

The concept was first outlined by Adam Back in 2013 and formalized by Gregory Maxwell in 2015. Maxwell's implementation built on elliptic curve cryptography to replace plaintext amounts with commitments that are verifiable but opaque. The protocol introduces no new cryptographic assumptions beyond the discrete logarithm problem on secp256k1: the same assumption that secures standard Bitcoin signatures.

On a transparent blockchain like Bitcoin, every transaction amount is publicly visible. This creates fungibility risks: coins with known histories can be treated differently by merchants or exchanges. Confidential transactions address this by making amounts invisible to outside observers while preserving the network's ability to enforce monetary policy.

How It Works

The core mechanism relies on Pedersen commitments, a cryptographic primitive with two essential properties: it hides a value behind a random blinding factor, and it is additively homomorphic, meaning committed values can be summed without being revealed.

Pedersen Commitments

Each transaction output replaces a plaintext amount with a commitment of the form:

C = x·G + a·H

Where:
  x = blinding factor (random secret known to sender and receiver)
  a = transaction amount
  G = standard elliptic curve generator (secp256k1)
  H = second generator derived by hashing G (nothing-up-my-sleeve construction)

The blinding factor ensures that the commitment reveals nothing about the amount. Even with unlimited computational power, an observer cannot determine the value: for any commitment, every possible amount has a corresponding blinding factor that would produce it. This property is called information-theoretic hiding.

At the same time, the commitment is computationally binding: the sender cannot change the committed amount after the fact without solving the discrete logarithm problem.

Homomorphic Verification

The additive homomorphic property is what makes CT practical. Because Pedersen commitments are additive:

C(x1, a1) + C(x2, a2) = C(x1 + x2, a1 + a2)

Sum of input commitments - Sum of output commitments = 0
(if and only if input amounts equal output amounts)

Validators check that the sum of all input commitments minus the sum of all output commitments equals a commitment to zero (plus any explicit transaction fee). If the equation balances, no coins were created or destroyed. The validator never sees any individual amount.

The sender shares blinding factors with the receiver using ECDH key agreement, so the receiver can construct their side of the commitment and later spend the output.

Range Proofs

Pedersen commitments alone have a critical vulnerability: because the underlying math uses modular arithmetic, an attacker could commit to negative amounts. For example, an input of 100 could be split into outputs of +101 and -1 (which wraps to a large positive number modulo the curve order), effectively creating coins from nothing.

Range proofs solve this by proving that every committed amount falls within a valid range (typically 0 to 2^64) without revealing the actual value. This is a form of zero-knowledge proof: the prover convinces the verifier that a statement is true (the amount is non-negative) without disclosing anything else.

Maxwell's original implementation used Borromean ring signatures for range proofs. A single 64-bit range proof required roughly 5,120 bytes per output. In 2017, Benedikt Bunz and Dan Boneh at Stanford proposed Bulletproofs, which reduced proof size to just 674 bytes for a 64-bit range: an 87% reduction. Bulletproofs scale logarithmically, meaning eight aggregated proofs occupy only 866 bytes versus over 40,000 bytes with the original scheme.

Blockstream Research has since developed Bulletproofs++, which compress a 64-bit range proof to 416 bytes (39% smaller than Bulletproofs) with roughly 4x faster verification. This work was accepted at Eurocrypt 2024 and is being implemented in libsecp256k1-zkp.

Implementations

Liquid Network

The Liquid Network, a Bitcoin sidechain operated by Blockstream, has used confidential transactions since its launch in 2018. Every transaction on Liquid hides amounts by default. Liquid also extends CT to hide asset types via a feature called Confidential Assets, which allows multiple token types (L-BTC, stablecoins, security tokens) to coexist on the same chain without revealing which asset is being transferred.

Liquid currently uses Borromean ring signature range proofs, with a planned upgrade to Bulletproofs++ that would reduce transaction sizes significantly. For a deeper look at Liquid's architecture, see the Liquid Network research article.

Monero (RingCT)

Monero activated RingCT (Ring Confidential Transactions) in January 2017, making it mandatory for all transactions by September 2017. RingCT combines three privacy layers: ring signatures hide the sender, stealth addresses hide the receiver, and confidential transactions hide the amount.

Monero upgraded from Borromean range proofs to Bulletproofs in October 2018, shrinking typical transactions from roughly 13.2 kB to 2.5 kB (an 80% reduction) and cutting fees by approximately 97%. A further upgrade to Bulletproofs+ followed in August 2022 with additional size and verification improvements.

Mimblewimble (Grin and Beam)

The Mimblewimble protocol, proposed pseudonymously in 2016, builds an entire blockchain around Pedersen commitments. Every transaction output is a commitment: there are no plaintext amounts or traditional scripts. This design enables "transaction cut-through," where intermediate transactions can be pruned from the chain history, dramatically reducing blockchain size over time.

Both Grin and Beam launched in January 2019 using Mimblewimble. A key tradeoff is that Mimblewimble requires interactive communication between sender and receiver to construct transactions, unlike RingCT where the sender can build a transaction unilaterally.

Why Bitcoin Mainnet Does Not Support CT

Bitcoin's base layer does not include confidential transactions, and adding them would require a soft fork consensus change. Several practical barriers make this unlikely in the near term:

• Transaction size: even with Bulletproofs, CT transactions are roughly 3x larger than standard transactions, reducing effective block space throughput
• Validation cost: verifying range proofs adds significant computational overhead (historically 30-60x compared to standard transaction validation)
• Node requirements: larger transactions and heavier validation increase the hardware needed to run a full node, potentially reducing network decentralization
• Consensus difficulty: achieving broad community and miner agreement on privacy-altering changes to Bitcoin is historically challenging
• Regulatory scrutiny: hidden amounts raise compliance concerns for exchanges and financial institutions subject to KYC/AML regulations

The sidechain approach, exemplified by Liquid, offers a pragmatic alternative: users who need transaction privacy can move funds to a CT-enabled sidechain, while Bitcoin's base layer preserves its current transparency and performance characteristics. For broader context on Bitcoin privacy tools and techniques, see the Bitcoin privacy landscape analysis.

CT vs. Zero-Knowledge Proofs

Confidential transactions and zero-knowledge proofs (ZKPs) are complementary, not competing technologies. CT is a protocol design that uses ZKPs as a building block: range proofs (whether Borromean, Bulletproofs, or Bulletproofs++) are themselves a form of zero-knowledge proof.

The distinction becomes clearer when comparing CT with systems like Zcash that use zk-SNARKs:

CT's reliance on standard discrete log assumptions (the same ones securing Bitcoin signatures) is a significant advantage: it avoids the more exotic mathematical foundations that some ZKP schemes require. For a deeper exploration of how zero-knowledge proofs apply to Bitcoin, see the ZKP applications in Bitcoin research article.

Why It Matters

Financial privacy is a fundamental requirement for sound money. Transparent blockchains expose transaction amounts to anyone with a block explorer, creating risks for businesses (competitors can monitor payment flows), individuals (anyone can see wallet balances), and the network itself (coins with known histories may trade at a discount, undermining fungibility).

Confidential transactions provide a targeted solution: they hide the most sensitive piece of data (the amount) while preserving the verifiability that makes blockchains trustworthy. As privacy-preserving technologies mature and range proofs become more efficient, CT could become a standard feature of Layer 2 networks and sidechains that build on Bitcoin. Projects in the Bitcoin scaling ecosystem, including those building on protocols like Spark, can draw on CT research to balance privacy with auditability.

Risks and Considerations

Auditability Tradeoffs

Hidden amounts make it harder to detect inflation bugs. If a flaw in the cryptographic implementation allows coins to be created silently, the network may not notice until the bug is independently discovered. With transparent amounts, unexpected supply changes are immediately visible. This is one reason Bitcoin's base layer has resisted adopting CT: transparent supply auditing is considered a core security property.

Transaction Size and Performance

Even with Bulletproofs, CT outputs are significantly larger than standard outputs. Each output carries a 674-byte range proof (416 bytes with Bulletproofs++), compared to roughly 34 bytes for a standard output script. This increases storage requirements, bandwidth usage, and synchronization time for nodes. Networks using CT must account for reduced throughput and higher per-transaction costs.

Regulatory Compliance

Exchanges and regulated financial institutions operating under KYC/AML frameworks may have difficulty supporting assets with hidden amounts. Chain analysis tools that rely on visible amounts become less effective with CT-enabled transactions. Some jurisdictions have considered restricting privacy coins entirely, though the regulatory landscape continues to evolve: the U.S. Treasury lifted sanctions on Tornado Cash in 2025, suggesting a more nuanced approach to privacy technologies.

Quantum Computing Threat

Pedersen commitments rely on the discrete logarithm assumption. A sufficiently powerful quantum computer running Shor's algorithm could break this assumption, potentially revealing all committed amounts retroactively. This is the same post-quantum threat that affects standard digital signatures on most blockchains, but the privacy implications for CT are particularly acute: amounts that were hidden could be exposed years later.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.