How to use Tor for crypto safely

Advisory: ProxyMark deanonymization paper (2026-07)

In July 2026, researchers published "Deanonymizing Monero Transactions in Tor Network" (Shi et al., arxiv.org/abs/2607.07062). The attack is node-operator-side, not user-side — it targets Monero nodes broadcasting transactions through Tor via a specific two-outgoing-hidden-service pattern. If you use Tor Browser to reach xmr.club, a swap engine, a wallet's web UI, or any other clearnet-shaped service, this paper is not about your session. If you run a Monero node behind Tor, see the advisory on /guides/run-a-monero-node.

Status as of 2026-08-08. The Monero Research Lab discussed the paper at the 2026-07-29 MRL meeting. Consensus in the room: only one of the paper's three heuristics is even partially patched (an onion-address leak, addressed by monero#9632 over a year ago); the other two (proxy-selection bias via unbounded self-reported block height, and timed sync/ping messages that defeat the noise protocol) are unpatched, no PR merged, no monerod release since the paper. Full linkability mitigation is expected from the FCMP++ hard fork (~February 2027), which replaces ring signatures with a stronger primitive the attack cannot pivot from. None of this affects users browsing over Tor Browser — the attack is node-operator-side. The general Tor-for-crypto advice below is unchanged. If you run a Monero node behind Tor, see /guides/run-a-monero-node for the operational implication.

What Tor protects (and what it doesn't)

Protects: your IP from the destination, the destination IP from your ISP. Hides which sites you visit. Hides timing/volume from passive network observers.
Doesn't protect: what you submit on a form, your browser fingerprint, login cookies, anything tied to a previously KYC'd identity. Doesn't hide that you use Tor from your ISP — they see encrypted Tor traffic. Use a bridge if the latter matters.
Doesn't protect from exit-node TLS strip on non-HTTPS sites — always check the lock icon.

Setup checklist (safest → easiest)

Tor Browser. Download from torproject.org. Don't install plugins, don't resize the window, leave the Security Level at "Standard" unless you know why you'd change it.
Bridge if your ISP blocks Tor. Use obfs4 / WebTunnel / Snowflake bridges from bridges.torproject.org.
Onion mirrors when offered. Use the .onion address of services you're visiting — keeps the entire circuit inside the Tor network and avoids exit-node trust. xmr.club's onion audit verifies operator-published mirrors.
Stagger fingerprints. Don't log in to KYC'd accounts in the same session as no-KYC ones. Use a separate Tor Browser instance (different data directory) per identity.

Wallets + Tor

Cake / Monerujo / Feather all have a "use Tor" toggle that routes wallet RPC through your local Tor daemon. Use it.
Remote node over Tor — pair the wallet with a public XMR remote node on its .onion address. /nodes lists vetted options with Tor mirrors.
Don't run your wallet alongside a clearnet browser session on the same machine if you care about correlation — VMs / different devices for serious threat models.

Common pitfalls

Enabling JavaScript everywhere. JS expands fingerprint surface enormously. Tor Browser Safest disables it; flip categories on per site as needed.
Login = identity link. Logging into the same email/X/GitHub via Tor and clearnet over time links the two. Use single-purpose accounts.
Browser window resize. Tor Browser pads window size to a common bucket; resizing breaks that. Don't.
Bookmarking onion URLs without verification. Verify each onion with the verification guide before relying on it.
Trusting an exit node. An exit node sees plaintext to the destination over HTTP. Always HTTPS, or always onion-only.

When you actually want a VPN instead

Tor isn't the only privacy tool. If your threat model is "ISP / employer / coffee-shop network", a no-KYC VPN may be enough and is much faster. If it's "state-level adversary" or "publisher's identity protection", Tor is the floor. Many users run Tor over a VPN; that hides Tor usage from the ISP at the cost of trusting the VPN. VPN picks →