You send someone 3 BTC. The amount settles onto a public ledger, visible to anyone with a browser and thirty seconds to spare. Most people shrug. But if you have ever received a salary in crypto, paid a supplier, or simply prefer that your financial life remain yours, that transparency stops feeling like a feature and starts feeling like a liability you didn't agree to carry.

Confidential transactions exist to fix it. The mechanism underneath them, Pedersen commitments, is one of those cryptographic constructions that sounds intimidating until someone draws the picture. So let's draw the picture.

What a Commitment Scheme Actually Does

Think of a commitment scheme as a sealed envelope. You write a number on a piece of paper, seal it, hand it to a stranger, and walk away. Later, you come back and open it. The stranger can verify you wrote that number before the reveal, not after. You cannot change what's inside. But they cannot read it until you decide to show them.

Two properties, always: binding (you cannot alter the value after committing) and hiding (no one learns the value until you open it).

Pedersen commitments satisfy both, but with an algebraic structure that allows arithmetic on the sealed envelopes without opening them. That last part is what makes them useful for money, and it is not a small thing.

The Math, Without the Suffering

A Pedersen commitment to a value `v` looks like this:

`C = v·G + r·H`

`G` and `H` are two generator points on an elliptic curve, public and fixed, known to everyone. `v` is your secret amount. `r` is a random blinding factor you choose yourself.

The result `C` is a point on the curve. It looks like noise. No one inspecting `C` can extract `v`, because the blinding factor `r` masks everything, a number dissolved within a larger algebraic structure with no visible seam. That is the hiding property.

Now here is what makes Pedersen commitments genuinely remarkable. They are additively homomorphic. If Alice commits to value `a` with blinding factor `r1`, and Bob commits to value `b` with blinding factor `r2`:

`C_Alice + C_Bob = (a+b)·G + (r1+r2)·H`

Add the commitments, get a valid commitment to the sum. No one revealed `a` or `b` to accomplish it.

How a Confidential Transaction Actually Checks Out

Consider a concrete scenario. Maya wants to send 7 coins to Dev and keep 3 coins as change, drawing from an input of 10 coins. In a confidential transaction, Maya publishes no plaintext figures. She publishes three commitments:

  • `C_in`: a commitment to 10 (her input)
  • `C_out1`: a commitment to 7 (Dev's output)
  • `C_out2`: a commitment to 3 (Maya's change)

Validators need to confirm that inputs equal outputs, that no new coins appeared. But they cannot see the amounts. This is precisely the point at which the homomorphic property does its work. The validator checks:

`C_in = C_out1 + C_out2`

If Maya chose her blinding factors such that `r_in = r_out1 + r_out2`, the equation holds. The validator observes the commitment arithmetic balance, which proves `10 = 7 + 3` without the validator ever learning 10, 7, or 3. Maya also attaches a range proof to each output, a step that most introductory accounts skip and absolutely should not.

The Inflation Bug Problem, and Why It Does Not Sneak Through

Here is the misconception that comes up repeatedly: people assume hiding amounts means you could smuggle in phantom coins. If no one can see the numbers, couldn't someone commit to -1000 on one output and pocket the surplus?

Mathematically, yes. A commitment to -1000 is structurally indistinguishable from a commitment to 7. The homomorphic check would still balance. Confidential transactions without range proofs would be, to use the precise term, catastrophically broken.

Range proofs close that hole. They are zero-knowledge proofs accompanying every output commitment, demonstrating cryptographically that the committed value falls within a specified range, typically 0 to 2^64 - 1, without disclosing the actual value. Validators verify the range proof. If it passes, the output cannot be negative.

Monero's RingCT implementation uses Bulletproofs for exactly this purpose. Bulletproofs reduced range proof sizes from several kilobytes to roughly 600 bytes per output, making confidential transactions viable at scale on a live network. The combination is the point: the Pedersen commitment proves amounts balance, the range proof proves no amount is negative. Both checks must pass, and the order is not negotiable.

Forging a valid range proof for a negative commitment would require solving the elliptic curve discrete logarithm problem. That is not a practical attack. It is, for current hardware and known algorithms, a computational wall. If someone ever breached it, the evidence would be immediate: on-chain supply figures would diverge from genesis parameters, auditable by anyone running a full node.

That divergence has not occurred. The record, so far as public audit goes, is clean.

What the Validator Sees, and What It Can Prove

So what does a network node actually learn from a confidential transaction? It learns that commitments balance. It learns all outputs fall within a valid positive range. It learns the transaction fee, which most implementations publish in the clear so that miners can prioritize by economic incentive. It does not learn individual amounts.

Ask yourself honestly: do you need to know that Maya sent Dev exactly 7 coins in order to confirm she did not fabricate coins from nothing? You do not. The cryptography separates two things most people assume are inseparable: knowing the amounts and verifying the supply. That separation is the entire point, and it holds.

Confidential transactions carry real costs. Range proofs add data. Verification demands more compute. Compliance-oriented use cases face genuine auditing friction, though selective disclosure mechanisms can address specific disclosure requirements without abandoning privacy wholesale. These are tradeoffs worth naming plainly, not burying in footnotes.

The core accusation, that hiding amounts necessarily conceals inflation, is simply incorrect. It conflates two distinct questions that Pedersen commitments are specifically designed to answer independently. The commitment structure is closer to a sealed envelope that a calibrated scale can still weigh than to one that surrenders nothing at all.

The cryptography does not trust Maya. It does not need to, and that is precisely why it works.