The one-paragraph answer
A confidential transaction is a blockchain transfer where the amount is encrypted on-chain but the network can still verify the math adds up — inputs equal outputs, no coins were created from thin air, and the sender actually had enough balance. It's the foundation that makes private digital cash possible on a public, auditable ledger.
Why amounts matter for privacy
On Bitcoin, every amount is public. If you receive a salary in BTC, anyone with your address can see exactly how much you earn, when you spend it, and what's left. Hiding the sender and receiver isn't enough — the amount alone is often enough to identify a wallet. Pay your $4,317.42 rent every month and you're trivially identifiable in a sea of round-number test transactions.
Confidential transactions solve this by encrypting the amount itself, while keeping the chain auditable enough that no one can secretly print coins.
The core trick: prove without revealing
A confidential transaction has to satisfy two requirements at the same time:
- Conservation: the sum of inputs equals the sum of outputs (plus the fee). No money is created or destroyed.
- Non-negativity: every output amount is a positive number — you can't "send" −1000 XEL to forge a balance out of nowhere.
Both checks have to happen without the verifying node ever seeing the actual numbers. That's where two pieces of cryptography come in: commitments and range proofs.
Pedersen commitments — sealing the envelope
A Pedersen commitment is a cryptographic envelope. You put a number inside, seal it, and hand it over. Anyone holding the sealed envelope can do two useful things:
- They can't see the number inside (binding).
- They can add two sealed envelopes together and the result is a sealed envelope containing the sum (homomorphic).
That second property is the magic. If a transaction has commitments to inputs A and B, and commitments to outputs C and D plus a public fee F, the network can compute commit(A) + commit(B) − commit(C) − commit(D) − F and check the result is a commitment to zero — without learning A, B, C, or D individually. Conservation, proved blindly.
Range proofs — closing the back door
Commitments alone aren't enough. Because they live in modular arithmetic, a malicious sender could craft an output with a huge negative number that wraps around to look positive. The conservation equation would still balance, but they'd have minted coins.
A range proof shuts this down by proving each output amount is within a sensible range — usually [0, 2⁶⁴) — without revealing what it actually is. Early range proofs were enormous (kilobytes per output). The breakthrough was Bulletproofs (2018), which compressed range proofs by an order of magnitude and made confidential transactions practical at scale.
How XELIS uses confidential transactions
XELIS goes a step further than classic confidential transactions. Where Bitcoin-style CT only hides amounts inside transactions, XELIS uses homomorphic encryption to keep balances themselves encrypted on-chain at all times. The chain never holds a plaintext balance, even between transactions.
Every XELIS transaction includes:
- An encrypted updated balance for the sender
- An encrypted output to the receiver
- A zero-knowledge proof that the sender's old balance was sufficient and the arithmetic is valid
The result: nobody — including miners, full nodes, or chain analysts — ever sees what anyone holds or transfers. See what is XELIS for the bigger picture of how this fits together.
What confidential transactions don't hide
CT solves the amount problem. By itself it doesn't necessarily hide the sender and receiver — that's a separate problem solved by techniques like ring signatures (Monero), shielded addresses (Zcash), or stealth addresses (XELIS). A complete privacy chain combines several techniques:
- Amount privacy: confidential transactions + range proofs
- Sender/receiver privacy: stealth addresses, encrypted address commitments, or ring signatures
- Metadata privacy: Tor / Dandelion routing for IP-level protection
Treat confidential transactions as one essential layer, not a complete privacy solution. See privacy wallets 101 for how these layers stack together.
Confidential vs shielded vs transparent
| Approach | Amount visible? | Sender visible? | Default for users? |
|---|---|---|---|
| Bitcoin (transparent) | Yes | Yes | Always |
| Liquid CT (sidechain) | No | Yes | Yes for L-BTC |
| Monero (ring signatures + RingCT) | No | Obscured | Always |
| Zcash (shielded pool) | No | No | Opt-in, rarely used |
| XELIS (encrypted balances + CT) | No | No | Always |
The auditability trade-off — and view keys
"If amounts are encrypted, how do I file my taxes?" is the most common question. The answer on XELIS is view keys: a separate cryptographic key you can voluntarily share with a specific third party — your accountant, your auditor, a regulator on legal request — that decrypts your transaction history without giving them spending control.
This is the right default: privacy by default, transparency on demand, controlled by the user. Compare that to transparent chains where you have no privacy by default and must rely on add-on tools to claw any back.
Frequently asked questions
Do confidential transactions slow the chain down?
They're larger and slightly more expensive to verify than transparent ones — a Bulletproof range proof is ~700 bytes versus a few bytes for a plaintext amount. Modern hardware verifies them in milliseconds. The trade-off is well worth the privacy.
Could a quantum computer break confidential transactions?
The cryptography used today (elliptic-curve based commitments and proofs) would be vulnerable to a sufficiently powerful quantum computer — but so would Bitcoin signatures, Ethereum keys, HTTPS, and most banking infrastructure. The whole industry is researching post-quantum replacements; CT-style schemes will migrate alongside everything else.
Can the network detect inflation if amounts are hidden?
Yes. The chain verifies the conservation equation (inputs = outputs + fee) cryptographically on every transaction. If someone tried to mint extra coins, the commitment math wouldn't balance and the block would be rejected. Supply auditability and amount privacy aren't in conflict.
Why don't all chains use confidential transactions?
Three reasons: bigger transactions, more expensive verification, and — most importantly — regulatory pressure. Many chains chose transparency to be exchange-friendly. XELIS chose privacy as the default and built compliance tooling (view keys) around it instead.
Related reading
- Homomorphic encryption explained — the math that makes XELIS encrypted balances work.
- What is a privacy coin? — the category, the techniques, and what counts.
- Privacy wallets 101 — how privacy techniques stack in a real wallet.
- What is XELIS? — the privacy Layer 1 in plain English.
- XELIS vs Monero — different privacy approaches compared head-to-head.