How bulletproofs shrank monero transaction sizes without losing privacy

11 November 2026

Bulletproofs reduced the size of Monero's range proofs from over 2.5 kilobytes per output to under 1 kilobyte, cutting total transaction sizes by roughly 80% while preserving the same mathematical guarantee that no one can create coins from nothing.

The problem bulletproofs solved

Before 2018, every Monero output required a range proof - a cryptographic proof that the amount being sent was between 0 and a maximum value (effectively 2^64 atomic units). These proofs were necessary because Monero hides all amounts using Pedersen commitments, which encrypt the numerical value. Without a range proof, someone could craft a transaction that appeared valid but actually created coins out of thin air - for example, committing to a negative amount or an absurdly large number.

The original range proofs used a scheme called Borromean signatures. Each output required a separate proof for each bit of the amount. For a 64-bit amount, that meant 64 small proofs bundled together. The result: each output added roughly 2.5 kilobytes of data to a transaction. A typical Monero transaction with two outputs (one to the recipient, one returning change) could exceed 13 kilobytes.

How Bulletproofs Work at a High Level

Bulletproofs replace the bit-by-bit approach with a single compact proof that uses a logarithmic structure. Instead of proving each bit individually, the prover constructs a single polynomial that represents the entire amount range, then uses a recursive technique to shrink that proof to a size proportional to the logarithm of the number of bits.

Key properties: - Size scales logarithmically: A Bulletproof for a 64-bit range is about 672 bytes. Doubling the range to 128 bits adds roughly 32 bytes, not 2.5 kilobytes. - No trusted setup: Unlike some zero-knowledge proof systems, Bulletproofs rely only on the standard elliptic curve assumptions used in Monero. No ceremony or trusted parameters are required. - Aggregation: Multiple Bulletproofs can be merged into a single proof. A transaction with two outputs uses one aggregated Bulletproof instead of two separate ones, further reducing overhead.

The practical impact on monero

When Bulletproofs were activated on the Monero network in October 2018 (as part of the v7 protocol upgrade), transaction sizes dropped dramatically:

The exact figures depend on ring size (then 10, now 16) and other factors. Current sizes are higher because the ring size increased from 10 to 16 in 2019 and other protocol changes added data. But the proportional savings remain.

Why smaller transactions matter

Smaller transactions mean: - Lower fees: Monero fees are based on byte size. A transaction that used to cost 0.04 XMR in fees now costs roughly 0.008 XMR at the same fee-per-byte rate. - More transactions per block: The 300 kB block weight limit could fit roughly 23 old-style transactions or about 120 Bulletproof transactions. This reduced network congestion and made the fee market more stable. - Faster sync: Full nodes download and verify every transaction. Smaller blocks mean less data to process, reducing sync times for new nodes and lowering bandwidth costs for existing ones.

The Verification Tradeoff

Bulletproofs are smaller but slower to verify than the old Borromean proofs. Verification time roughly doubled per output. This tradeoff was acceptable because: - The size savings were massive (80% reduction). - Verification happens on full nodes, which have dedicated hardware. - The network as a whole benefited more from reduced block sizes than it lost from slightly slower verification.

Limitations and later developments

Bulletproofs are not a perfect solution for all privacy contexts: - They only prove that an amount is in a valid range. They do not hide the sender, receiver, or transaction graph - those are handled by ring signatures and stealth addresses. - The proof size, while much smaller than before, still adds about 2.5 kB to a typical transaction. For very high-frequency or micro-transaction use cases, this is still significant. - Monero later upgraded to a more efficient variant called Bulletproofs+ in 2022, which shaved another ~10% off proof sizes and reduced verification time by about 20%.

How to See the Difference Yourself

You can check current Monero transaction sizes using any block explorer that displays the "size" field: 1. Find a recent transaction hash on a site like MoneroBlocks.info or XMRchain.net. 2. Look for the "size" or "tx size" field. 3. Compare it to the historical average of 13 kB before Bulletproofs.

The exact size will vary based on ring size (currently 16), number of outputs, and whether the transaction uses subaddresses or other features. But any transaction under 3 kB owes most of its compactness to Bulletproofs.

Back to privacy coins