stealth address

A stealth address solves the receiver-privacy half of the problem: it lets you publish a single, reusable address — on your website, in a tip jar, in a profile — while every payment actually lands at a fresh, unlinkable one-time address that only you can detect and spend. To an outside observer scanning the chain, ten donations to you look like ten payments to ten unrelated strangers. Nobody can see your balance, count your income, or link your published handle to the on-chain outputs.

The mechanism is Diffie-Hellman key exchange. Your published address is really two public keys: a view public key and a spend public key. To pay you, the sender generates a random ephemeral key pair, combines their ephemeral private key with your view public key to compute a shared secret, and uses that secret to derive a brand-new one-time public key as the destination. They also attach the ephemeral public key to the transaction. Because of the symmetry of Diffie-Hellman, you can recompute the very same shared secret using your private view key and the published ephemeral public key, recognising which outputs are yours, while your private spend key is what actually authorises spending them.

Monero builds this into every transaction via the dual-key CryptoNote stealth-address scheme, which is why Monero addresses are never reused on-chain even though you hand out one address. The idea has since been ported to smart-contract chains: Ethereum's ERC-5564 standardises stealth addresses on secp256k1, with ERC-6538 providing a registry so senders can look up a recipient's stealth meta-address. The separation of view and spend keys is also what enables view keys for selective auditing — you can hand someone the scanning ability without the spending ability.

The subtle costs are real. The recipient must scan every transaction on the chain (or a filtered subset) trying to derive the shared secret, which is computational work that grows with chain activity. And stealth addresses hide the receiver and unlink payments, but on a transparent chain they do not hide the amount or the sender's input graph — they are one ingredient of privacy, best combined with confidential amounts and sender-side mixing.