Monero: The Price of Privacy

Ring signatures, stealth addresses, tail emission, RandomX — a full technical breakdown of how Monero actually works, checked against primary sources instead of market hype. What the protocol really hides, what it doesn't, and what it costs.

An investigation into emission, fungibility, decentralization, security, and the choices that set Monero apart from Bitcoin

1. Two Questions About Digital Money#

Bitcoin reveals. Monero conceals. That's the distance between the two protocols, boiled down to two verbs.

Bitcoin asks: how do you build digital money that's scarce, publicly verifiable, and censorship-resistant, without relying on a central authority?

Monero asks: how do you build digital money that's private, fungible, and censorship-resistant, without relying on a central authority?

The similarity is deceptive. The second half of each sentence — "publicly verifiable" versus "private" — is where the two projects part ways on fundamental design priorities. These aren't the same idea wearing different clothes. They're architectures that accept different trade-offs to arrive at different properties.

Monero isn't Bitcoin with a veil over it. It's a system that decided, from the drawing board, that privacy wouldn't be an optional layer bolted on later — it would be part of consensus itself.

This piece doesn't start from a winner. What follows tries to show, as precisely as the facts allow, what each choice costs. Only after weighing those trade-offs, in the final chapter, will I lay out my own position — not as a verdict on which protocol is objectively superior, but as a personal choice based on the properties I consider essential in a monetary system.

2. Where Monero Came From#

The story starts in 2014, with the CryptoNote protocol, created by an author writing under the pseudonym Nicolas van Saberhagen. Its first implementation, Bytecoin, carried an 80% premine — enough on its own to trigger immediate distrust in the community.

That distrust gave rise to a fork called BitMonero, later renamed Monero — "coin" in Esperanto — after a second fork led by a group of seven developers, most of them pseudonymous. The best known, Riccardo Spagni ("Fluffypony"), served as the project's lead maintainer for five years before stepping down in December 2019, handing the role to another developer on the team. Spagni said publicly — both in a 2018 Reddit post and in a Decrypt interview announcing his departure — that the goal was to reduce the project's dependence on him and to "further decentralize" Monero. That's a stated intention from the source itself, not an outside interpretation.

Monero launched with no premine and no ICO. That matters, because part of the criticism the coin faces today — concentration of decision-making power among its developers — needs to be weighed separately from the original token distribution, which was, by design, egalitarian.

The core point is this: privacy in Monero isn't a bolted-on feature. It's the project's reason for existing. Every architectural decision covered below flows from that founding premise.

3. What Bitcoin Reveals — and What Monero Conceals#

On Bitcoin, a transaction is pseudonymous, not anonymous: the address, the amount, and the full history of UTXOs (the unspent outputs that make up each wallet's balance) are public and permanent. Anyone can trace a coin's path all the way back to the block where it was mined.

Monero tries to hide three things in every transaction: who sent it, who received it, and how much was sent. It does this with four mechanisms working together:

Ring signatures blend the sender's real key with a group of "decoys" pulled from the blockchain, so an outside observer sees a set of possible senders without being able to isolate the real one.

Stealth addresses generate a unique, one-time address for every incoming transaction, derived from the recipient's public address — so repeated payments to the same user never appear linked on the blockchain.

RingCT (Ring Confidential Transactions) hides the transacted amount, using cryptographic commitments instead of numbers in plain sight.

Bulletproofs are zero-knowledge proofs that show committed values fall within valid ranges, while the cryptographic commitments themselves let anyone verify that value is conserved without ever revealing the actual amounts — which blocks arbitrary coin creation even when the numbers stay hidden.

The point here isn't a cryptography lecture. It's to understand that each piece protects one specific piece of information — and that the sum of these pieces is what makes Monero structurally different from Bitcoin, not just "Bitcoin with the volume turned down."

4. Privacy Isn't Absolute Anonymity#

Privacy on Monero operates across three distinct layers, and conflating them is the single most common mistake among both users and critics:

The blockchain layer — sender, recipient, and amount are hidden by the mechanisms described above. This is where the protocol delivers on its promise, with technical caveats we'll get into in Chapter 10.

The network layer — the IP address of whoever broadcasts a transaction can, in principle, be observed by anyone positioned to watch for it. Monero uses Dandelion++ to make that correlation harder, routing a transaction's initial propagation through a random path before it hits the broadcast stage. Users who rely on remote nodes hand part of that protection off to a third party, since they don't run one of their own. That's a real risk, not a hypothetical one: in August 2025 the project itself patched a privacy leak, in version 0.18.4.2, that occurred specifically when interacting with malicious remote nodes.

The user layer — no cryptography protects against a compromised device, an operational mistake (reusing identifiers, spending funds in predictable patterns, leaking metadata outside the network), or external correlation through regulated exchanges that require identification.

Put plainly: Monero's cryptographic privacy doesn't make a user invisible across every layer of the system. It significantly reduces what the blockchain itself reveals — and nothing more than that.

5. The Hard Question: How Do You Verify Money Nobody Can See?#

If the amount in every transaction is hidden, how does the protocol stop someone from creating coins out of thin air?

The answer lies in Pedersen Commitments, a cryptographic scheme that lets you commit to a value without revealing it, while preserving the property that sums and comparisons still work mathematically. Every transaction output carries a commitment of this kind. Bulletproofs step in as the "range proof" — they demonstrate that a committed value falls within a valid range (not negative, not exceeding supply) without ever exposing the number itself.

Emission itself — the creation of new coins through the block reward (coinbase) — isn't private. That's a detail people often overlook: the block reward is public and verifiable by any node, which means the scheduled emission can be checked block by block.

What you can't do is directly sum every UTXO in circulation the way you can on Bitcoin, because the individual amounts in private transactions are hidden. Verification, on Monero, rests on the mathematical soundness of the cryptographic proofs — not on a direct, public arithmetic sum.

Said precisely: Monero doesn't offer the same direct, public auditability that Bitcoin does — which is a very different claim from saying "Monero can't be audited." The gap between those two sentences isn't a nuance. It's what separates an honest critique from an inaccuracy that sounds more damning than it actually is.

6. The Question That Bothers People Most: Is Monero Inflationary?#

Yes — and the question worth asking isn't whether it is, but how much, why, and compared to what.

Monero's main supply, 18.132 million XMR, was fully emitted by May 2022. From that point on, tail emission kicked in: 0.6 XMR per block, indefinitely, with a new block roughly every two minutes. There's no hard cap — Monero's supply keeps growing forever, even though the percentage rate of growth keeps shrinking over time, because the denominator (total supply) keeps rising while the numerator (0.6 XMR per block) stays fixed.

The case for it is economic, not ideological: permanent emission guarantees miners a predictable block subsidy regardless of how much transaction fee volume exists. Supporters of tail emission argue this provides a permanent floor under miner incentives, reducing the risk of a scenario where mining stops being profitable, hashrate collapses, and the network becomes vulnerable to attack.

The case against it is also economic: permanent emission rules out absolute scarcity, continuously dilutes existing holders, and breaks with the "hard money" model that Bitcoin's 21-million cap represents.

Any honest analysis has to include the counterpoint: Bitcoin has its own unresolved monetary question. What will secure the network once the block subsidy approaches zero and mining depends entirely on a transaction fee market? That market's behavior, in that scenario, has never been observed across decades of real operation. It's a real problem, actively debated within the Bitcoin community itself, and it exists precisely because Bitcoin chose the opposite path from Monero.

Neither model has definitively solved the very-long-term security problem. They just chose different risks.

7. Two Monetary Policies, Two Risks#

Maximum supply — Bitcoin: 21 million. Monero: no hard cap.

Block subsidy — Bitcoin: declining to zero. Monero: permanent, 0.6 XMR per block.

Emission model — Bitcoin: predictable new issuance, progressively decreasing, capped at a known ceiling. Monero: permanent emission, with a percentage inflation rate that declines over time.

Nature of scarcity — Bitcoin: absolute. Monero: percentage-decreasing.

Long-term security — Bitcoin: increasingly dependent on the fee market. Monero: also sustained by ongoing emission.

Supply verification — Bitcoin: direct, public observation. Monero: cryptographic verification.

The question without an easy answer: which risk would you rather live with — future dependence on a fee market that's never been tested at real scale over decades, or permanent emission whose percentage impact on existing supply keeps shrinking? There's no objectively correct answer. There are only different priorities about what "sound money" means over the very long run.

8. Privacy Produces Fungibility#

Fungibility — the property that every unit of a currency can be swapped for any other, with no distinction based on history — isn't a minor technical detail. For many monetary economists, it's a structural requirement for any money that actually functions as money.

On Bitcoin, every coin's full history is public. That lets exchanges, compliance tools, and even governments flag specific UTXOs as "tainted" — because they passed through addresses linked to illicit activity, sanctions, or mixers — and refuse, freeze, or treat those coins differently from others.

Monero tries to block that distinction right at the consensus layer: because each coin's history is hidden by the mechanisms covered in Chapter 3, there's no such thing, in theory, as an identifiable "tainted coin."

The uncomfortable but central question is this: is money really fungible if every unit carries a public history that can be used against its owner? The answer splits people who value traceability (for compliance, criminal investigation, transparency) from people who value fungibility by default at the protocol level (as a fundamental monetary property). It's not a technical question — it's a question of values.

9. The Cost of Privacy: Complexity#

To hide sender, recipient, and amount all at once, Monero needs a significantly more complex cryptographic stack than Bitcoin's: ring signatures, RingCT, Bulletproofs, and — still in development — FCMP++, which we'll cover in detail in Chapter 17.

Let's be clear about this before going further: complexity isn't proof of insecurity. Complex cryptographic systems can be just as robust as simple ones, provided they're correctly implemented and audited.

But the right question to ask isn't "is this insecure?" — it's: the greater the cryptographic complexity, the larger the surface that has to be audited, tested, and maintained over time — right? That's an engineering question, not an accusation. And Monero's documented history of privacy bugs, which we'll walk through next, is the most direct empirical evidence available for answering it.

10. When Privacy Fails#

Monero's documented history of privacy vulnerabilities includes three relevant episodes, each technically distinct from the others:

2021 — a bug in the decoy-selection algorithm. It affected sender privacy on very recently received outputs (spent within roughly 20 minutes of receipt). Fixed in v0.17.2.3.

2023 — an off-by-one error in the "gamma picker" (decoy selection). It affected sender privacy specifically for outputs exactly ten blocks old, across versions v0.13.0.0 through v0.18.2.1 — an exposure window of roughly three years. Fixed in v0.18.2.2.

2025 — a privacy leak triggered by interaction with malicious remote nodes. It affected users who relied on remote nodes. Fixed in v0.18.4.2.

The first two bugs, though often cited together, are technically different: the 2021 bug hit very recent spends; the 2023 bug specifically hit outputs exactly ten blocks old and had a much longer exposure window — roughly three years between the bug's introduction and its fix — which drew legitimate criticism over how long it took to catch.

This isn't about saying "Monero is flawed." It's more precise than that: the track record shows that privacy by default doesn't eliminate vulnerabilities — it turns implementation quality into a core part of the monetary security itself. A privacy bug in a system that promises privacy by default carries a different weight than an equivalent bug in a system that never promised confidentiality in the first place.

11. RandomX: Decentralization, or Just a Promise?#

From the start, Monero adopted an ethos of ASIC resistance (application-specific integrated circuits), on the premise that specialized hardware centralizes mining among a small number of players with capital and scale.

The current algorithm, RandomX, activated in November 2019 after two earlier hard forks failed to keep ASICs off the network for good, was designed to favor general-purpose CPUs — in theory, any ordinary computer can mine Monero competitively.

But three concepts that frequently get merged in discussions of this topic need to be pulled apart: ASIC resistance is not the same thing as mining decentralization, which is in turn not the same thing as security against a 51% attack. An algorithm can resist specialized hardware quite well and still let the network get captured by a coalition of pools or by an external economic incentive — as the next chapter demonstrates.

12. The Qubic Episode#

In August 2025, a mining pool tied to the Qubic project — led by Sergey Ivancheglo, IOTA's co-founder — went from under 2% of Monero's hashrate in May to over 25% in July, and claimed to have crossed 51% on August 11-12.

The mechanism wasn't a cryptographic break of RandomX. It was an external economic incentive: Qubic's "useful proof-of-work" model converted Monero mining rewards into USDT, which was then used to buy and burn the QUBIC token itself — pulling in hashrate through profitability, not through any affinity with the Monero network.

There were two distinct episodes here, not one. On August 11-12, 2025, the Qubic-linked pool produced a six-block reorganization, orphaning roughly 60 blocks of recent history. That prompted Kraken to temporarily suspend XMR deposits as a precaution. Then, on September 14, 2025, a second and larger event reorganized 18 blocks, reverting somewhere between 117 and 118 transactions — the biggest reorg ever recorded in Monero's history, confirmed by multiple independent security and specialist sources.

The network's immediate response included Kraken's temporary deposit suspension, an accelerated migration of miners to P2Pool, and a discussion, led by Monero Research Lab researchers, about temporarily adopting DNS-based checkpoints as a mitigation.

The critical distinction this episode demands: Qubic didn't break RandomX. What the episode revealed, instead, is an economic vulnerability in Proof-of-Work security itself: hashrate can respond to incentives entirely external to the asset it's supposed to be protecting. And the DNS checkpoints, proposed as a stopgap, expose a paradox worth flagging: a measure meant to protect the network from hashrate centralization introduces, in itself, an element of centralization — trust in a handful of community-run DNS servers.

13. ASICs: The Problem That Changed#

Monero's ASIC resistance is no longer absolute. Bitmain released the Antminer X5 in 2023 — an ASIC built specifically for RandomX, rated at 212 KH/s and 1,350W — followed by the X9, with even higher throughput. This is real hardware, openly sold, with specs published by the manufacturer itself.

What isn't well established — and what this piece refuses to state without solid grounding — is what share of the network's total hashrate these ASICs currently occupy. Most of the available sources on that specific number are mining-hardware sales sites, which have a direct commercial interest in how the metric gets framed, and no independent, reliable measurement of the current percentage turned up.

The correct conclusion, then, is this: the existence of specialized hardware undercuts the idea of absolute ASIC resistance, but without reliable data, it doesn't support the claim that ASICs currently dominate the network.

14. P2Pool: Decentralizing What, Exactly?#

P2Pool is a peer-to-peer mining protocol with no central operator: instead of trusting a pool server to build the block template and distribute payouts, miners collectively maintain a sidechain (a "sharechain") that tracks recent contributions and pays out directly in the coinbase transaction.

That eliminates a real risk vector: a centralized pool operator could, in theory, censor transactions, withhold payouts, or be coerced into acting against the network. P2Pool removes that dependency.

But it's worth being precise about what it doesn't solve: P2Pool doesn't stop an entity from accumulating enough hashrate to attack the network — as the Qubic episode itself demonstrated, since that attack didn't route through P2Pool at all, but through traditional centralized pools. P2Pool reduces dependence on a central operator for mining coordination and reward distribution. On its own, it doesn't solve the problem of computational power concentration.

15. Decentralization Isn't One Word#

"Monero is decentralized" is a sentence that only means something once you specify which layer:

Mining — technically open to any CPU, but exposed to economic attacks like Qubic's.

Pools — real concentration among a handful of major traditional pools, mitigated but not eliminated by P2Pool's existence.

Nodes — growing storage and computational requirements, including significant RAM for RandomX's fast mode, push a portion of users toward remote nodes — with the privacy implications already discussed.

Development — a small, mostly pseudonymous core group concentrates central technical decisions, including the hard fork schedule.

Governance — informal consensus among developers and the community, with no formal on-chain vote.

Exchanges — increasingly concentrated on smaller, unregulated platforms as major exchanges exit the asset (Chapter 18).

The right question is never "is Monero decentralized?" — it's "decentralized in which layer, and at what cost to the others?"

16. Hard Forks: Centralization or Coordination?#

Monero schedules mandatory hard forks — historically twice a year, more spaced out these days — to evolve the protocol, including changes to the mining algorithm and future cryptographic upgrades like FCMP++.

The critique: mandatory upgrades require centralized coordination, depend on a small group of developers to spec out changes, and create capture risk — if that group gets it wrong, or is coerced, the entire network is affected at once.

The defense: coordinated hard forks avoid the fragmentation that protocols with optional upgrades run into (Bitcoin itself has seen contentious fork attempts, like SegWit2x), and they let necessary cryptographic changes — like replacing ring signatures with FCMP++ — get adopted network-wide, simultaneously, preserving the anonymity set for every user at once.

The frequency of hard forks is a verifiable fact. Calling that "centralization" is an interpretation — a legitimate one, but one that needs to be demonstrated with evidence of actual decision capture, not simply inferred from how often updates happen.

17. FCMP++: When the Code Contradicts the Marketing#

FCMP++ (Full-Chain Membership Proofs) is the most ambitious cryptographic upgrade ever planned for Monero: it would replace the current ring signatures — which blend the real transaction with a fixed set of 16 decoys — with a zero-knowledge proof showing that the spent input belongs to the set of every output that has ever existed on the blockchain, without revealing which one. That would expand the anonymity set from 16 to, in theory, the network's entire output base — today numbering in the hundreds of millions.

Throughout 2025 and 2026, a significant amount of content — mostly from exchange sites, investment guides, and mining blogs, not primary technical sources — began claiming that FCMP++ was already "live on mainnet," or that an activation hard fork had already been "shipped," attaching specific dates (late 2025, Q1 2026, August 2026) to that milestone.

Checking the primary source tells a different story. The official "fcmp++ hf" milestone in the monero-project/monero repository on GitHub shows, as of the check date (August 20, 2026): 64% complete, no due date set, with fourteen issues and pull requests still open — including the central integration pull request, opened in August 2024, still marked as a draft ("not ready"). Foundational components, like the CARROT key-derivation protocol and cryptographic wrappers, were still under active review in July and August 2026, including the search for a second independent audit of the FCMP++ cryptographic circuit.

The rule here is simple.

Code and primary documentation take precedence over market narrative.

This isn't about accusing any site of fraud — it's probably a mix of optimism, staleness, and content recycling among outlets that copy each other without checking the original source. What can be stated with precision is this: there's a significant gap between the narrative published by secondary sources and the state indicated by the protocol's official development. As of this piece's publication date, FCMP++ is an actively developed, substantial project with no confirmed activation date.

The development status described above is a snapshot taken on the check date and may change after publication.

18. Regulation: Privacy Has a Political Cost#

Regulatory pressure on Monero intensified in a well-documented way between 2024 and 2026. Binance completed a global delisting of XMR in February 2024. Kraken suspended the asset for European Economic Area customers in October 2024, amid tightening European AML/CFT requirements — MiCA rules and the EU's Anti-Money Laundering Regulation (AMLR) — and restrictions that regulated platforms began applying to privacy-enhancing assets. Kraken extended the measure to Canada in September 2025. OKX removed XMR trading pairs in January 2024.

Aggregate figures like "73 delistings in 2025," widely repeated across content on the topic, show up across multiple publications without a clearly traceable primary source — so this piece doesn't treat that number as solid, only as an indication of a real, well-documented trend visible through the specific cases cited above.

The question regulation puts to Monero is structural, not incidental: if privacy is a core feature of the protocol, how does a private asset survive when the regulated intermediaries that provide access to it are legally required to know their customers and the origin of the assets they offer? So far, the answer has been a migration of liquidity toward decentralized exchanges, peer-to-peer swaps, and no-KYC exchange tools — which solves the access problem, but not the regulatory legitimacy one.

19. Liquidity and Adoption#

The exit of major regulated exchanges reduced Monero's liquidity on conventional centralized platforms, shifting part of the trading volume toward non-custodial channels and over-the-counter markets.

What matters here isn't passing judgment on that shift, but recognizing the tension behind it: privacy can be technically desirable and economically hard to distribute at scale, because the dominant financial infrastructure — exchanges, banks, payment processors — operates under regulatory regimes that demand exactly the kind of transparency Monero is designed not to offer.

20. What Monero Actually Solves#

After all these problems, it's worth giving the protocol its technical due for what it genuinely delivers:

Privacy by default, with no extra configuration required from the user.
Concealment of sender, recipient, and amount at the blockchain layer.
Structural resistance to blockchain analysis that classifies coins by history.
Fungibility as a protocol property, not an optional feature.
A mining incentive model that doesn't depend exclusively on a future fee market.

21. What Monero Doesn't Solve#

By the same token, it's worth listing, without euphemism, what the protocol doesn't guarantee:

A compromised user device.
Metadata leaks outside the blockchain layer.
Every risk at the network layer, especially for users who depend on remote nodes.
Regulatory pressure and exclusion.
Liquidity comparable to assets with broad institutional adoption.
Implementation errors — the 2021, 2023, and 2025 track record shows this isn't hypothetical.
Ongoing development risk, inherent to any protocol undergoing active cryptographic evolution.
Absolute monetary scarcity.

22. Bitcoin and Monero: Two Philosophies#

There's not much point in asking which protocol is "better." It's more useful to ask what each one treats as non-negotiable.

For Bitcoin, a core priority is the public verifiability of the system's state: any network participant can, at any moment, directly and publicly confirm the entire state of the system — how many coins exist, who holds them, and the full history of every movement.

For Monero, a core priority is discretion: the system is designed to expose the minimum information necessary, even if that means giving up direct, public verification in favor of cryptographic verification.

That opposition is a strong one, but it needs a caveat: Bitcoin isn't simply "transparency" — it has partial privacy through pseudonymity, and additional privacy layers are actively being built for it. Monero isn't simply "anonymity" — as we've seen, it operates in layers, with clear limits. These are architectures with different priorities, not absolute extremes.

23. The Price of Privacy#

What Monero pays for privacy includes: greater cryptographic complexity, the absence of direct public auditability, permanent monetary emission, heavier regulatory pressure, and a deeper dependence on continuous, well-executed technical evolution — as FCMP++ itself is proving demanding.

What Bitcoin pays for its model includes: a public history that partially undermines fungibility, exposure of financial behavior patterns to any observer, and an unanswered, very-long-term security question about what will sustain mining once the block subsidy approaches zero.

Neither model is free.

Bitcoin sacrifices some privacy in exchange for radical public auditability. Monero sacrifices some of that auditability in exchange for confidentiality and fungibility.

One depends on absolute scarcity and on a fee market that will increasingly have to carry its security. The other accepts permanent emission to preserve a continuous mining incentive.

And maybe that's the real difference between Bitcoin and Monero.

Not what each protocol promises to protect.

What each one is willing to sacrifice to do it.

24. What I'm Not Willing to Pay#

Everything presented up to this point was investigation. This last chapter is something else: it's a position.

Having examined both systems, my choice is Bitcoin.

Not because I think Monero is technically useless, or because I think the privacy it offers has no real value. Quite the opposite — throughout this piece I've tried to show that Monero genuinely solves a problem that Bitcoin deliberately doesn't solve the same way. Fungibility and confidentiality by default are real properties, achieved through serious cryptographic engineering.

But for me, three things take priority over privacy by default: decentralization, direct public verifiability, and resistance to coordinated changes in the system's fundamental rules.

And it's exactly on that last criterion that I split the two protocols. Not because Bitcoin is free of points of concentration — it has its own, in mining, in development, in infrastructure, like any real system does. But because, in my judgment, it's harder for a relatively small group to coordinate and impose changes to Bitcoin's fundamental rules than it is for Monero's.

Monero has genuine decentralization across several of the layers this piece has examined: mining that's technically open, P2Pool as an alternative to centralized pools, independent node operation, an active development community, real censorship resistance. I recognize all of that. But I consider it significant that mandatory changes and hard forks depend on a relatively concentrated technical core. The protocol needs recurring, coordinated upgrades just to preserve its own privacy guarantees, and it has to keep reinventing itself cryptographically at a fast pace — from RingCT to FCMP++. As I read it, that depends on a more concentrated form of technical coordination than I'm willing to accept as part of the design of money I'm supposed to trust for decades.

There's a second factor in my choice that I haven't made explicit until now: Bitcoin's monetary policy. I value a maximum supply of 21 million BTC and predictable, progressively decreasing new issuance. What I consider fundamental here isn't some economic classification of the currency — it's the predictability of the rules: new bitcoin issuance is determined by the protocol, decreases progressively, and is capped at a known ceiling of 21 million BTC. It doesn't depend on some future decision by an authority to determine how much money gets created. To me, that predictability is a fundamental monetary property.

By contrast, Monero adopted permanent emission through tail emission — even though tail emission itself decreases in percentage terms and serves a legitimate economic function, as I showed in Chapter 6.

It's that same predictability that makes me consider Bitcoin, over the long run, the sounder store of value between the two. Not because the market has already reached unanimous agreement on that today, but because the combination of a known maximum supply, decreasing emission, and resistance to coordinated change is exactly what sustains monetary confidence across decades — not across market cycles.

Monero, by contrast, strikes me as less efficient as a long-term store of value — not because the technology is flawed, but because of the combination of the two factors I've already laid out: an emission that never stops diluting existing supply, even if at a decreasing rate, and the recurring need for cryptographic re-engineering to stay secure and private, from RingCT to FCMP++. An asset that has to keep technically reinventing itself this often carries, for me, a kind of long-term risk that Bitcoin, by design, avoids.

To sum up the hierarchy of criteria behind my choice: decentralization; direct public verifiability; resistance to coordinated changes to fundamental rules; predictable monetary policy; a capped maximum supply; progressively decreasing emission; and, as a consequence of all of that, greater soundness as a long-term store of value. I'm not saying these criteria make Bitcoin objectively superior for everyone, in every context. I'm saying these are the criteria I consider essential, and that, for me, they outweigh the privacy-by-default that Monero offers.

This is my personal judgment, not a mathematical verdict. A technically informed reader can look at the exact same evidence laid out in this piece and land on the opposite conclusion — they might consider Monero's technical coordination a legitimate form of protocol maintenance rather than centralization, and conclude that privacy, fungibility, confidentiality, resistance to blockchain analysis, and even permanent emission itself outweigh the criteria I've prioritized. That disagreement is reasonable, and it doesn't invalidate my choice — just as my choice doesn't invalidate theirs.

Bitcoin's costs, laid out in the previous chapter, don't disappear because I prefer this system. They're still there, and an honest piece can't pretend otherwise.

I accept that price. I'd rather live with Bitcoin's problems than the ones I see in Monero.

There's no such thing as digital money without trade-offs. The question was never finding the perfect system — it's deciding which trade-offs we're willing to carry.

I choose Bitcoin.