confidential transaction

A confidential transaction hides how much money moved while still letting every node verify that no money was created out of thin air. This sounds paradoxical — how can validators confirm the books balance if they cannot see the numbers? The trick is to replace each clear amount with a cryptographic commitment that is hiding (reveals nothing about the value) yet additively homomorphic (commitments can be summed), so the network can check that inputs minus outputs minus fee equals zero without ever learning a single amount. The design was introduced by Gregory Maxwell in 2015 and underpins amount privacy in Monero's RingCT, Blockstream's Liquid sidechain, and Mimblewimble.

The engine is the Pedersen commitment. A value v is committed as C = v*H + r*G, where G and H are two elliptic-curve generators whose discrete-log relationship nobody knows, and r is a secret random blinding factor. Because r is uniformly random, C leaks nothing about v (perfect hiding); because finding two different openings would require solving a discrete log, you cannot later claim a different value (computational binding). Homomorphism is the magic: C1 + C2 commits to v1 + v2 with blinding r1 + r2. So a verifier checks that the sum of input commitments equals the sum of output commitments plus the fee commitment; if the transaction is balanced, the value parts cancel and what remains is a commitment to zero, which the spender proves by revealing that its blinding factors sum to a known value.

There is a dangerous gap to close. Pedersen commitments live in a finite field of order n, so arithmetic wraps around modulo n. A malicious spender could commit to a 'negative' amount that is really a gigantic number close to n, making outputs appear to sum correctly while secretly inflating the supply. To block this, every output commitment must be accompanied by a range proof showing in zero knowledge that the committed value lies in a sane interval such as [0, 2^64) — non-negative and not large enough to wrap. Confidential transactions are therefore always Pedersen commitments plus range proofs.

Be clear about scope: confidential transactions hide amounts, not necessarily the senders, receivers, or the link structure of the transaction graph. On Bitcoin-like chains you still see which outputs feed which inputs. Full privacy comes from layering CT with sender anonymity (ring signatures) and receiver anonymity (stealth addresses), which is exactly what Monero's RingCT does, or from a fully shielded model like Zcash where the entire transaction lives inside a zero-knowledge proof.