“Monero in 2025: Persistent Use and Emerging Network-Layer Insights,” published February 13, 2026.
Persistent use despite regulatory pressure: Monero (XMR) transaction activity remains stable and resilient, at a level higher than before 2022, even though many large platforms have delisted it or listed it with restrictions, and enforcement pressure on more “transparent” crypto assets has increased.
Preferred in theory, less used in practice (ransomware): Ransomware actors often prefer XMR for privacy (even offering “discounts” if paid in XMR), but most actual ransom payments are still in bitcoin, due to ease of acquisition, liquidity, and ability to convert at scale.
Greater adoption in darknet markets: In 2025, nearly half (48%) of new darknet markets supported only Monero, a sharp increase from previous years and a sign of a shift toward privacy coins in high-risk environments.
Effect of delistings: less liquidity and more friction: The article highlights that, following restrictions/delistings on large exchanges, liquidity is more concentrated in offshore or lower-compliance venues, contributing to more volatility and making XMR use more operationally “frictional.”
New focus: the “network layer” (P2P) and its implications: TRM and academics analyzed the behavior of the P2P network and found that ~14–15% of reachable peers exhibit non-standard behavior (timing, handshakes, peer list composition, etc.). They do not automatically equate this with malice, but they do observe infrastructure concentration (a few operators/environments host a disproportionate share), which could provide structural visibility into message propagation and affect certain theoretical assumptions about anonymity, even though Monero's on-chain cryptography remains intact.
https://www.trmlabs.com/resources/blog/monero-in-2025-persistent-use-and-emerging-network-layer-insights
Cyph3rp9nk
npub1ln…arrnt
2026-02-25 08:18:53 UTC
Author Public Key
npub1lnms53w04qt742qnhxag5d6awy7nz6055flnmjkr6jg39hm86dlq7arrntSeen on
wss://relay.damus.ioPublished at
2026-02-25 08:18:53 UTCEvent JSON
{
"id": "e1af218d02a94ee769f752c05eb0d420cb39abf45637a36ccac9d2b65344a538",
"pubkey": "fcf70a45cfa817eaa813b9ba8a375d713d3169f4a27f3dcac3d49112df67d37e",
"created_at": 1772007533,
"kind": 1,
"tags": [
[
"r",
"wss://bcast.girino.org/"
],
[
"r",
"wss://nos.lol/"
],
[
"r",
"wss://nostr.mom/"
],
[
"r",
"wss://nostr.oxtr.dev/"
],
[
"r",
"wss://premium.primal.net/"
],
[
"r",
"wss://bostr.shop/"
],
[
"r",
"wss://relay.damus.io/"
],
[
"r",
"wss://relay.primal.net/"
],
[
"r",
"wss://relay.mostr.pub/"
],
[
"r",
"wss://relay.nostr.net/"
],
[
"r",
"wss://relay.coinos.io/"
],
[
"r",
"wss://relay.snort.social/"
],
[
"r",
"wss://nostr-pub.wellorder.net/"
],
[
"r",
"wss://relay.nos.social/"
]
],
"content": "“Monero in 2025: Persistent Use and Emerging Network-Layer Insights,” published February 13, 2026.\n\nPersistent use despite regulatory pressure: Monero (XMR) transaction activity remains stable and resilient, at a level higher than before 2022, even though many large platforms have delisted it or listed it with restrictions, and enforcement pressure on more “transparent” crypto assets has increased.\n\nPreferred in theory, less used in practice (ransomware): Ransomware actors often prefer XMR for privacy (even offering “discounts” if paid in XMR), but most actual ransom payments are still in bitcoin, due to ease of acquisition, liquidity, and ability to convert at scale.\n\nGreater adoption in darknet markets: In 2025, nearly half (48%) of new darknet markets supported only Monero, a sharp increase from previous years and a sign of a shift toward privacy coins in high-risk environments.\n\nEffect of delistings: less liquidity and more friction: The article highlights that, following restrictions/delistings on large exchanges, liquidity is more concentrated in offshore or lower-compliance venues, contributing to more volatility and making XMR use more operationally “frictional.”\n\nNew focus: the “network layer” (P2P) and its implications: TRM and academics analyzed the behavior of the P2P network and found that ~14–15% of reachable peers exhibit non-standard behavior (timing, handshakes, peer list composition, etc.). They do not automatically equate this with malice, but they do observe infrastructure concentration (a few operators/environments host a disproportionate share), which could provide structural visibility into message propagation and affect certain theoretical assumptions about anonymity, even though Monero's on-chain cryptography remains intact.\n\nhttps://www.trmlabs.com/resources/blog/monero-in-2025-persistent-use-and-emerging-network-layer-insights",
"sig": "2ea0bb147f5340144d51f0400b13c542d22080dce6cbc04ad0b7c371976e5924778cf1bfaf6fe1c547c6e9263e789787a57a00c3631297d193a68641d8c3c0aa"
}