▶ Watch the full video on YouTube · or on Monerica Video
Monero hides the sender, the receiver and the amount on every transaction — that's the reason people use it. But there's a layer underneath the blockchain that Monero does nothing about: your network connection. Your wallet has to talk to a node, and that conversation goes out over your IP address.
If you've never thought about that, this article is for you. VPN, Tor, or neither: here are the tradeoffs and when each one makes sense.
Disclosure: the video this article is based on is sponsored by Xeovo, a VPN that accepts Monero. The sponsor section is clearly marked below, and links to Xeovo are referral links that may earn Monerica a commission.
What a VPN actually does
VPN stands for Virtual Private Network, and it's a tunnel. Your traffic goes encrypted from your device to a server run by the VPN company, and from there it goes out to the internet under that server's IP address. Your internet provider sees that you're connected to a VPN and nothing else. The website or node on the other end sees the VPN's IP, not yours.
That's how it works — and it means the VPN company is now the one that can see both who you are and where you're going. A VPN doesn't remove trust, it moves it. You're trusting the VPN provider instead of your ISP.
That can be a very good trade, because you can pick a provider with a real no-logs policy and pay in a way that doesn't tie back to you — with Monero, and with no email address. But understand what you're buying: privacy from your ISP and from the sites you visit, not anonymity from the VPN itself.
What Tor actually does
Tor stands for The Onion Router, and it works differently from a VPN. Your traffic bounces through three volunteer relays, each wrapped in its own layer of encryption. The first relay knows your IP but not where you're going. The last relay — the exit — knows where you're going but not who you are. No single relay sees the whole picture, and there's no company to subpoena.
The tradeoff is speed and reliability. Tor is slower, sometimes a lot slower; connections drop; and many normal websites block or CAPTCHA anything coming from an exit node.
Tor also has a side benefit for Monero specifically: you can connect to onion-address nodes, which means your traffic never leaves the Tor network at all. No exit node, no clearnet — just you and the node, inside Tor.
The question that matters: who are you hiding from?
Before you pick a tool, answer one question honestly: who are you hiding from?
Most people don't want their ISP building a profile of their habits, don't want a random remote node operator logging their home IP, and don't want their wallet traffic sitting in plain view on the coffee shop Wi-Fi. That's a VPN threat model.
A smaller group has a harder answer. They can't afford for any single company to know they use Monero, they live where sending a transaction is actively watched, or they run a service that must stay genuinely unlinkable from their identity. That's a Tor threat model.
Be honest about which one you are. Picking the heavier tool when you don't need it usually means you'll stop using it, because it's slower and more work. The best tool is the one you'll actually keep using.
Where Monero leaves you exposed
Here's exactly what we're protecting. When your wallet syncs, it asks a node for blocks and broadcasts your transactions through that node. If you use a remote node, the operator sees your IP and what you're asking for.
A malicious node can't steal your funds and can't see your balance. But it can log which IP broadcast which transaction, and it can try to feed you a bad view of the chain.
If you run your own node, you've removed the remote node operator from the picture entirely. But your node now peers with other nodes on the network, and the transaction you broadcast still originates from your IP. Dandelion++ helps obscure that origin, but it isn't a guarantee. So the network layer is a real gap — and it's the gap both of these tools are trying to close.
Sponsor: Xeovo
The video is sponsored by Xeovo, a VPN provider based in Finland — outside the Fourteen Eyes — with a strict no-logs policy.
What matters most for this topic is how you pay. Xeovo takes Monero (plus cash in the mail and a couple of other coins), and you don't need to hand over an identity to sign up: no name, no email, no phone number.
- No bloated app: you get standard WireGuard and OpenVPN configs to drop into the official clients — less to trust, and it runs on anything.
- Works everywhere: Windows, Mac, Linux, iPhone and Android, with setup guides on their site.
- Stealth options for places that block VPN protocols.
- Up to five devices on one account, no trackers or analytics on their site, and a yearly transparency report.
- A Tor address, so you can buy the VPN without ever exposing your real IP.
If you've decided a VPN is the right tool for you, check out Xeovo: xeovo.com → · Tor · Monerica listing
When is a VPN the right call?
A VPN is the right call for the everyday case:
- Syncing your wallet from home or on public Wi-Fi.
- Connecting to a remote node you don't fully trust.
- Running your own node without advertising your home IP to every peer on the network.
- Visiting Monero sites, forums and directories without your ISP logging every one of them.
It's fast enough that you probably won't notice it, it can always be on, and it works with just about every site. The whole value of a VPN is that it's practical enough to leave running 24/7.
The caveat is that you have to pick a good one. Pay anonymously, confirm it uses WireGuard or OpenVPN rather than proprietary bloatware, and don't use a free VPN — a free VPN is usually an ad network logging your browsing and selling it.
When is Tor the right call?
Tor is the right call when a VPN's single hop isn't good enough:
- Your threat model includes the VPN provider itself.
- You want your wallet to talk to a node over an .onion address, so nothing ever touches the clearnet.
- You're broadcasting a transaction you want unlinkable not just from your ISP, but from everyone.
- You're in a jurisdiction where using Monero is itself the problem — Tor is built for that.
It's well supported: most Monero wallets can route through Tor or a SOCKS proxy, and many public nodes publish onion addresses. Just accept that it'll be slow and connections may drop, and keep it for the things that actually need it.
Mistakes to avoid
Don't log into a KYC exchange over Tor. You're already identified there; Tor just makes the exchange flag your account.
Don't chain a VPN and Tor without a reason. Unless you have a specific reason and understand the ordering, it doesn't help: done wrong, it does nothing, and done right, it may not be much better.
Don't assume Tor hides what your wallet does from a malicious node. The node still sees your transaction; it just doesn't see your IP.
Don't forget what matters most: the wallet software you run, where you get it from, and whether you've verified it yourself.
A good setup
A good setup has two parts:
- A Monero-paid VPN, always on, on every device. That covers most worries.
- Your wallet pointed at a node over Tor — either your own node with an onion address, or a trusted public onion node.
That way your general traffic is covered by the VPN and your wallet traffic never leaves Tor. If you only want to do one thing, run the VPN, and add a Tor address for the wallet if you can. Neither is 100% perfect for total anonymity, but together they let you use Monero privately.
Final thoughts
A VPN is for practical, everyday privacy from your ISP and from nodes. Tor is for when you can't afford to trust any company, and especially for wallet-to-node traffic over onion addresses. Figure out who you're hiding from, then pick the tool that matches. Both have their purpose.
Thanks to Xeovo for sponsoring the video. For places to swap and spend Monero, check out Monerica, the Monero economy directory.
