Darknet Adoption Sustains Monero as Exchanges Retreat

Monero (XMR) transaction volume is holding steady, driven by a significant shift toward the privacy coin in darknet markets, according to new research from TRM Labs. This sustained demand occurs even after major exchanges, including Binance and Kraken, delisted XMR in 2024 due to regulatory pressure. Further restrictions came in 2025 when Dubai’s financial regulator banned privacy coins on licensed platforms. Despite these headwinds, on-chain data shows Monero's usage in 2024 and 2025 remained above levels seen prior to 2022.

The report highlights a key driver for this resilience: a pronounced increase in adoption by illicit marketplaces. In 2025, 48% of newly launched darknet markets supported only Monero, a "notable increase compared to earlier years." While Bitcoin remains the primary currency for ransomware payments, some operators now offer discounts for payments made in the more anonymous XMR.

15% of Network Nodes Flagged as Potential "Spy" Risks

While Monero’s on-chain cryptography, which obscures senders, recipients, and transaction amounts, remains unbroken, the TRM Labs report identified potential network-level vulnerabilities. Researchers found that approximately 14% to 15% of Monero nodes behave unusually, exhibiting irregular timing patterns and clustering on specific servers. This behavior suggests the presence of "spy nodes."

These nodes do not break Monero's encryption but may be operated by a single entity to observe how transaction data propagates across the peer-to-peer network. By seeing which computers receive transaction information first, an observer could gain clues about a transaction's original IP address, chipping away at the coin's anonymity guarantees.

Although Monero’s on-chain cryptography remains unchanged, network behavior can impact theoretical anonymity properties if observers can see message propagation.

— TRM Labs

Monero Deploys Update to Counteract Network Snooping

In response to growing concerns about network-level snooping, the Monero project released a software update in October 2025 to bolster user privacy. The update, named Fluorine Fermi (v0.18.4.3), introduced an improved peer-selection system designed to protect users from these spy nodes.

This new system actively steers user wallets away from suspicious parts of the network and toward nodes with safer, more typical behavior. The move addresses long-standing concerns, which intensified after a leaked 2024 video suggested investigators could monitor network activity through their own nodes, sparking widespread debate on Monero's real-world privacy.