Monero Wallet & Windows Defender: False Positives, Safe Setup, and Whitelisting (Windows 10/11)

Windows Defender quarantined your Monero wallet or monerod.exe? That is almost always a false positive. The Monero GUI includes an optional miner, and real malware often hides miners, so security tools treat mining code with suspicion. This guide (updated October 2026, Monero v0.18.5.4 “Fluorine Fermi”) shows how to prove your download is genuine, then let Windows run it without turning your protection off.

• Short answer: Download only from getmonero.org/downloads, verify the signed hash, then restore the file and add a folder exclusion for the wallet folder only.
• If verification fails: delete the file. Do not allow it.

Why Windows Defender Flags Monero

• The built-in miner. The Monero GUI ships with optional mining (and P2Pool support). Defender often reports this as PUA:Win32/CoinMiner (“potentially unwanted app”), not as a virus.
• Machine-learning guesses. Detections ending in !ml (for example Trojan:Win32/…!ml) are automated guesses, common for new releases that few PCs have run yet.
• No reputation yet. Each new Monero release is a fresh, open-source build that Microsoft has not seen often, so Windows is cautious about it.

None of these mean the file is safe on their own. Verification is what tells a real Monero download apart from a fake one.

Step 1: Download From the Official Site Only

• Monero GUI or CLI: getmonero.org/downloads. For Windows there is a 64-bit installer and a 64-bit zip for the GUI, and 64-bit and 32-bit builds of the CLI.
• Feather Wallet (lighter desktop wallet): featherwallet.org. If Defender flags it, see our Feather Wallet false-positive guide.

Avoid mirrors, “portable” repacks, and links from videos, forums or ads. Fake Monero wallets that steal seeds are real; they are the reason the next step matters.

Step 2: Verify the Download

1. Install Gpg4win (it includes Kleopatra) from gpg4win.org.
2. Get the signing key binaryfate.asc from the Monero repository: github.com/monero-project/monero/…/binaryfate.asc. Import it in Kleopatra and check the fingerprint is exactly:
   81AC 591F E9C4 B65C 5806 AFC3 F0AF 4D46 2A0B DF92
   If it does not match, stop.
3. Verify the hash list. Download hashes.txt and open it with Kleopatra’s Decrypt/Verify. It must report a valid signature.
4. Hash your download and compare it with the matching line in hashes.txt. In Command Prompt:
   certutil -hashfile monero-gui-install-win-x64-v0.18.5.4.exe SHA256
   or in PowerShell: Get-FileHash .\monero-gui-install-win-x64-v0.18.5.4.exe -Algorithm SHA256

Official walkthrough: Verify binaries on Windows (beginner).

Step 3: Restore the File From Quarantine

Only after the file verified:

1. Open Windows Security › Virus & threat protection › Protection history.
2. Open the entry for the Monero file and check the path is your wallet folder.
3. Choose Actions › Allow on device (or Restore).

Step 4: Add a Folder Exclusion (Not “Turn Defender Off”)

1. Go to Windows Security › Virus & threat protection › Manage settings.
2. Under Exclusions, choose Add or remove exclusions › Add an exclusion › Folder.
3. Pick the Monero program folder. The installer’s default is C:\Program Files\Monero GUI Wallet; if you used the zip, pick the folder you extracted it to.

Or in PowerShell as administrator:
Add-MpPreference -ExclusionPath "C:\Program Files\Monero GUI Wallet"

• Keep it narrow: exclude only the Monero folder. Never exclude C:\, your whole user folder, or Downloads.
• Mining tools: if you use XMRig or P2Pool, give them their own folder and exclude only that, after verifying them from github.com/xmrig/xmrig or github.com/SChernykh/p2pool.
• Where your data lives: the blockchain is stored in C:\ProgramData\bitmonero and wallets in Documents\Monero\wallets by default. These hold data, not programs, and normally need no exclusion.

Blocked, but Not by Defender? SmartScreen and Smart App Control

• SmartScreen shows “Windows protected your PC” for new downloads Windows does not recognise yet. After you have verified the file, click More info › Run anyway.
• Smart App Control (Windows 11) blocks unsigned apps outright, and has no per-app exception. The only option is to turn it off in Windows Security › App & browser control › Smart App Control settings, install the verified wallet, then turn it back on. Since the April 2026 Windows 11 update you can usually turn it back on without reinstalling Windows; on older builds, turning it off was permanent.

Tell Microsoft It’s a False Positive

You can report a wrongly flagged, verified Monero file at Microsoft’s file submission page. Choose Home customer and Incorrectly detected as malware/malicious; signing in is optional. Reports help future users and future releases.

Stay Safe While You’re at It

• Your seed is everything: write the 25 words on paper or steel. Never photograph it or store it in cloud notes or a password manager you sync.
• Update from the official site: new releases fix bugs and security issues. Verify each new download the same way.
• Use a standard Windows account day to day, not an administrator.
• Larger balances: consider a hardware wallet (see our hardware wallet guide).

FAQ

Should I just turn off Windows Defender to install Monero?

No. Verify the download, restore it, and exclude only the Monero folder. Everything else on your PC stays protected.

Defender says “PUA:Win32/CoinMiner”. Is my wallet infected?

If the file came from getmonero.org and its hash matches the signed hashes.txt, no. That detection is about the optional miner built into the GUI.

The hash doesn’t match. What now?

Delete the file and download it again from getmonero.org. If it still does not match, do not use it: it is not the official build.

Does an exclusion make my PC less safe?

Slightly, for that one folder only. That is far safer than disabling Defender, and verification is what makes it safe to do.

Useful Links

• Official Monero downloads: getmonero.org/downloads
• Signed hash list: getmonero.org/downloads/hashes.txt
• Windows verification guide: getmonero.org
• Report a false positive: Microsoft file submission
• More Monero wallets and tools: Monerica – Wallets

For education only. Always verify software from official sources before allowing it, and keep Windows and your security tools up to date.

Related Articles

• Feather Wallet Virus? It's a False Positive
• Monero Wallet Windows
• Best Monero (XMR) Wallet For Desktop & Mobile
• Best Monero Hardware Wallet

Comments

Name

Email

Website (optional)

Comment

Post Comment