The reality is that 82% of the coins were already mined before its ‘public’ release. Even if the premined coins weren’t done so maliciously, it still means 82% of the coins in the hands of persons unknown and invisible.
The person who later became Monero’s lead maintainer wrote that about Bytecoin — the first currency built on CryptoNote, the one Monero forked away from, and the entire reason it exists. His own count put the number at 151 billion of a possible 184 billion BCN, already mined before the coin’s existence was known outside the project.
A user calling themselves thankful_for_today announced the fork on April 9, 2014, and launched BitMonero nine days later with no premine of its own. It lasted seven days: on April 25, after thankful_for_today failed to work with the community, seven developers forked again, dropped the “Bit,” and kept building as Monero. Two forks in seventeen days is not a design process so much as a founding principle — whoever holds the supply before launch cannot be trusted to hold it fairly after. The twelve-chain design comparison already places Monero closer to Bitcoin on distribution and system decentralization than any other chain in its table. What that table has no room to show is how far Monero then diverged, on purpose, on the two questions Bitcoin answered the opposite way: whether the ledger should be readable, and whether issuance should ever stop.
What the CryptoNote document says about Bitcoin
The CryptoNote document Monero implements does not hide what it finds wrong with Bitcoin. It sets two conditions for electronic cash and states, without hedging, that Bitcoin clears only one of them:
(Monero annotated CryptoNote whitepaper)Untraceability: for each incoming transaction all possible senders are equiprobable. Unlinkability: for any two outgoing transactions it is impossible to prove they were sent to the same person. … Unfortunately, Bitcoin does not satisfy the untraceability requirement.
Satoshi conceded the same point years earlier, in his warning that Bitcoin is pseudonymous rather than anonymous — the line the CryptoNote paper’s complaint sharpens into a stated design requirement rather than a caveat.
Its second objection targets mining, and throws Satoshi’s own words back at the network:
(Monero annotated CryptoNote whitepaper)Therefore, Bitcoin creates favourable conditions for a large gap between the voting power of participants as it violates the “one-CPU-one-vote” principle since GPU and ASIC owners posses a much larger voting power when compared with CPU owners.
Neither objection stayed on paper. The first became ring signatures and stealth addresses; the second became RandomX. Both were written into Monero’s code in the years that followed.
Hiding the ledger: ring signatures, stealth addresses, and RingCT
| Technique | What it hides | Introduced |
|---|---|---|
| Ring signatures | The sender | From launch |
| Stealth addresses | The recipient | From launch |
| RingCT | The amount | January 2017; mandatory that September |
| Bulletproofs | The size of the amount proofs | October 2018; transaction size cut by at least 80% |
Monero answers untraceability with a ring signature. A sender’s real output is pooled with decoy outputs pulled at random from the existing chain, and the signature proves only that some member of that pool authorized the spend — never which one. Ring size used to be the sender’s choice, and a conspicuously small ring was itself a signal to look closer. With the October 2018 release that brought Bulletproofs, the network fixed the size at 11 for everyone, and the August 2022 “Fluorine Fermi” hard fork raised it to its current 16: one real output plus 15 decoys. A node validates the whole ring and cannot tell the real output from the decoys, which is the entire point.
Unlinkability is a separate problem, solved a separate way. A recipient publishes a single address carrying two public keys, a view key and a spend key, and that address never receives funds directly. The sender combines those keys with a fresh random number, on the same principle as a Diffie–Hellman key exchange, to compute a brand-new one-time destination address for every payment, and only the recipient’s private keys can later recognize and spend from it. Two payments to the same person land at two addresses that look, to everyone but the two parties involved, like payments to two different people.
Amounts were the last piece to fall, and they cost the most to hide. RingCT, activated at block 1,220,516 in January 2017 and made mandatory that September, conceals the transaction amount itself while still letting the network verify that inputs equal outputs — proving a hidden number isn’t negative, without revealing the number, takes more data than a plaintext comparison ever would. Bulletproofs, added in the October 18, 2018 hard fork, replaced the earlier proof method and cut the size of these confidential transactions by at least 80 percent.
Mining: the arms race RandomX ended
Monero didn’t answer the mining objection with one algorithm; it answered with a policy of replacing the algorithm on a schedule. CryptoNight, the proof-of-work function it launched with, leaned on memory bandwidth specifically because memory is expensive to specialize in silicon — the same premise Litecoin built into Scrypt, a premise dedicated hardware eventually defeated on both chains. Once dedicated CryptoNight hardware appeared, Monero’s response was to keep tweaking the algorithm’s fine details roughly every six months, retiring whatever hardware had just been built for it — a war of attrition rather than a solution. The objection RandomX answers is one the proof-of-stake chains answered by leaving mining altogether; the proof-of-work versus proof-of-stake comparison measures what each route cost.
RandomX, activated November 30, 2019 at block 1,978,433, ended that cycle instead of continuing it. Rather than one fixed set of operations to build a circuit around, RandomX generates a new random program for every hash attempt — a sequence of integer arithmetic, floating-point math, and branches — and runs it against a dataset of about 2 gigabytes that gets fully rebuilt every 2,048 blocks, roughly every 2.8 days. A general-purpose CPU already runs exactly this mix efficiently; a circuit built to accelerate one fixed program has nothing to specialize around, because the program itself keeps changing. Four independent firms — Trail of Bits, X41 D-Sec, Kudelski Security, and QuarksLab — audited the algorithm between May and August 2019, before it ever touched mainnet; Arweave paid for the first audit and donations from the Monero community paid for the other three.
The emission curve, and a 64-bit accident at its ceiling
| Bitcoin | Monero | |
|---|---|---|
| How issuance declines | Halves every 210,000 blocks (a staircase) | Shrinks a little every block, in proportion to the remaining supply |
| The ceiling | 21 million, a round number its designer chose | About 18,446,744, a by-product of the integer type chosen |
| Where issuance ends | Reaches zero around 2140 | Locked at 0.6 XMR per block since the end of May 2022 |
Monero recomputes its block reward every single block rather than halving on a fixed schedule: subtract every coin already mined from a constant called the money supply, then shift the result right by 19 bits — equivalent to dividing by 2^19 and dropping the remainder. The shift was 20 bits under the original one-minute blocks; doubling the block time to two minutes took one bit off it, so each block pays twice as much. Bitcoin’s reward falls in steps, once every 210,000 blocks; Monero’s falls by a small amount on every block, a continuous curve rather than a staircase. The CryptoNote document’s complaint about Bitcoin’s halving was exactly this shape:
(Monero annotated CryptoNote whitepaper)The original intention was to create a limited smooth emission with exponential decay, but in fact we have a piecewise linear emission function whose breakpoints may cause problems to the Bitcoin infrastructure.
The money-supply constant in that formula is 18,446,744,073,709,551,615 — 2^64 minus 1, the largest number a 64-bit unsigned integer can hold. Divided by Monero’s smallest unit, one trillionth of an XMR, that constant is a supply of 18,446,744.07 XMR — call it 18.4 million. Bitcoin’s 21 million is a number its designer chose. Monero’s ceiling is a number nobody chose at all: it is what falls out of picking a 64-bit integer type for the money-supply variable and never revisiting it.
That ceiling was never actually reached. Once the formula’s output falls below 0.3 XMR per minute, the code stops shrinking the reward and locks it at that floor — 0.6 XMR per two-minute block. Monero crossed that floor at the end of May 2022 and has paid exactly 0.6 XMR to every block since, with no scheduled end. Bitcoin’s supply approaches 21 million and stops. Monero’s keeps growing forever: a dilution of less than 1 percent a year, shrinking as a share of the total but never reaching zero.
No premine, no foundation: funding development without either
Nobody profited from Monero’s launch the way Bytecoin’s early holders had. There was no presale, no developer allocation, and no company or chief executive ever stood behind the chain — the same absence the digital-gold structural reading treats as one of Bitcoin’s own load-bearing features. thankful_for_today, the pseudonymous figure who started it all, disappeared soon after the April 25 fork and never resurfaced under that name, which looks like the same shape as Satoshi’s departure. One difference keeps the match from being complete: Bitcoin had no successor after its founder left, while several of the developers who forked Monero away — Spagni foremost among them — stayed publicly attached to the project for most of a decade.
Development still had to get paid for, and Monero’s answer has no single paymaster. The Community Crowdfunding System lets anyone post a funding proposal in the open, where the community argues over scope and price before a Core Team escrows the donated funds and releases them against completed milestones rather than against a roadmap a foundation board set. Routine costs that don’t fit any single proposal are covered by a separate General Fund anyone can donate to directly. No entity decides what gets built; whether a proposal draws enough donations decides it. That absence of any single organization holding power over the protocol is the concrete mechanism behind Monero’s place in the cross-chain comparison.
What Spagni has said about Bitcoin
The lead maintainer’s own position was never that Bitcoin had failed. It was narrower and harder to dismiss: Bitcoin’s transparency is a real property with a real consequence, and Monero is that consequence. He said as much:
Riccardo Spagni (What Bitcoin Did interview, October 8, 2018)As Bitcoin proved not to be anonymous, there is a significant and obvious use case for Monero.
He pushed the same transparency argument the other direction too — not just that Bitcoin lacks privacy, but that its readability isn’t the safety net people assume it is. He made the point:
Riccardo Spagni (Coin Story interview, December 30, 2020)At the end of the day, Bitcoin is not immune to auditibility risks. And you can see that because there have been two clear inflation bugs on Bitcoin. The first was actually exploited in 2010 when someone created billions of bitcoins… The second one was a little more of an issue and that was the 2018 CVE, which was double spending transaction outputs.
Both bugs are recorded on this site. The 2010 value overflow incident was exploited on the live chain, while CVE-2018-17144 was found and disclosed before anyone exploited it, so the first half of his claim holds and the second needs a condition. A readable supply is auditable in principle but is no guarantee that bugs are absent — and the same readability is what made both of them discoverable. Spagni’s record works through the full comparison.
Monero’s tail emission, plotted against Bitcoin’s cap and ten other currencies on one normalized index:
Significance to Bitcoin
Monero’s ring signatures descend from CryptoNote, not from Bitcoin’s own code — the fork-and-altcoin genealogy places it outside Bitcoin’s direct lineage entirely. It earns a place in Bitcoin’s record anyway, because it meets the fair launch and system decentralization that Bitcoin’s structural features list, in the same shape Bitcoin does: no premine, no foundation, no company, and no single organization holding the supply.
On top of that agreement, Monero chose the opposite answer on exactly two questions: should the ledger be readable, and should issuance ever stop. The first difference has already been tested, by Bitcoin’s two inflation bugs, faults a readable ledger made visible; Monero’s hidden amounts buy privacy at the price of a supply that’s harder to audit. The second has not been tested yet: a coin count that never finishes counting. Bitcoin’s 21 million is a number a designer chose. Monero’s own ceiling of about 18.4 million was never chosen at all — a by-product of a 64-bit integer, on the one chain in this record that forked away from another specifically because it didn’t trust what an unaudited number can hide.
