Could someone show me an actual example of a single transaction formed from two private keys.

Say I have 5 XMR in one private key, and 10 XMR in another, so there are two unique private keys. How do I sign a transaction for 15 XMR so that it sends all those coins to a new address in one single transaction?

The comments in this thread will perhaps be helpful: https://www.reddit.com/r/Monero/comments/6hjnlh/any_tutorials_on_how_to_sign_a_transaction_with/

I would like to see the actual hashes and code as an example with explanations of what it is.

  • The purpose of this is to send coins to a multisig address simultaneously.
    – user1471
    Commented Jun 17, 2017 at 6:08

1 Answer 1


In Monero, every output has a one-time (unique) public key. No output on the blockchain can be associated with any particular wallet address because these output public keys are not the same as your wallet's public keys.

Outputs can be spent if there is knowledge of the one-time private key that corresponds to the output's one-time public key.

Therefore, a transaction that spends two outputs that were sent to the same wallet address is indistinguishable from a transaction that spends two outputs that were sent to two different wallet addresses, because all that needs to be known are the one-time private keys corresponding to the outputs you want to spend.

The code for scanning for incoming outputs and for constructing a transaction is very long and complicated. The summary is that an output is detected as being yours by calculating P' = Hs(aR)G + B where a is your private view key, B is your public spend key, R is the transaction public key published with each transaction and G is the Elliptic Curve base point. You check P' against each output P on the blockchain and if there is a match, then that output is destined for you. The private key that allows you to spend this output is x = Hs(aR) + b where b is your private spend key.

Once you have the private keys for both of the outputs, you can spend them as usual in a transaction as if both of them were your own outputs. This involves constructing a transaction data structure with its own transaction public key, creating new outputs for the recipient based on the recipient's wallet address, creating a ring signature to obscure the source inputs, using Pedersen commitments to prove no Monero were created or destroyed in the transaction (because the amounts are encrypted and not publicly observable), and creating a range proof that demonstrates that no cheating is going on with the Pedersen commitments.

If you want to learn more, the best place to start is the Cryptonote white paper which will introduce you to how Monero transactions work https://cryptonote.org/whitepaper.pdf and the Monero Research Lab papers which detail how ring signatures and confidential transactions work https://lab.getmonero.org/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.