Short answer: A Monero remote node is someone else's copy of the blockchain that your wallet connects to, so you can use Monero without downloading about 280 GiB of data. The node never gets your keys, balance or addresses, but it does see your IP address and the transactions you send through it. Pick a synced node with good uptime, connect over Tor where you can, and run your own node if privacy matters most.
Key points
- A remote node cannot steal your Monero or see your balance. Your wallet scans the chain locally with its own keys.
- It can link your IP address to the transactions you broadcast, unless you connect through Tor.
- A malicious node can also try subtler tricks, such as serving bogus decoys or manipulating fee data.
- Good remote nodes are fully synced, stable over time and ideally reachable as a .onion address.
- The Monero Research Lab spy node ban list (version 2, 431 entries) helps your own node avoid suspected spy nodes.
- A pruned node of your own needs roughly 93 GiB and removes the trust question completely.
What is a Monero remote node?
Every Monero wallet needs a node: a computer running the monerod software with a copy of the blockchain. The wallet asks the node for new blocks, checks them for its own payments, and hands the node any transaction it wants to send.
A local node runs on your own machine or network. A remote node is run by someone else and reached over the internet. Mobile wallets and the simple modes of the Monero GUI use remote nodes, because that skips a sync that takes days and a download that public nodes reported as about 280 GiB on 9 November 2026.
What a remote node can and cannot see
| Information | Visible to the node? | Notes |
|---|---|---|
| Private keys and seed | No | They never leave your wallet. |
| Balance and addresses | No | The wallet works these out locally. |
| Incoming payments | No | The node cannot tell which outputs are yours. |
| Recipient and amount of what you send | No | Hidden by Monero itself, from every node. |
| Your IP address | Yes | Unless you connect through Tor or another proxy. |
| Which transaction you broadcast, and when | Yes | The node can tie that transaction to your IP. |
| Roughly when you sync and from which block | Yes | The node sees which blocks your wallet requests. |
This matches what Feather's documentation says: a remote node does not know your addresses or balance, cannot steal funds and cannot detect incoming transactions.
The same page lists what a malicious node can do. It can associate your outgoing transactions with your IP address on clearnet. It can make your transactions stand out by manipulating the fee your wallet pays. And it can attempt an attack that may reveal the true input of a transaction; Feather describes this as having a low chance of success and says the wallet warns you if it detects it. The official Monero guide adds that some publicly advertised nodes exist only to do this kind of thing, by linking IP addresses to transaction IDs or serving bogus decoys.
So the realistic risk is not theft. It is an operator, or whoever obtains their logs, learning that your IP address sent a particular transaction at a particular time.
How to pick a remote node
- Synced. The node's block height should match the network tip. A node that is behind shows you an old balance and may fail to send.
- Uptime. Prefer nodes that have answered consistently over the last day or longer, not one that appeared an hour ago.
- Operator. A node run by a known community member or wallet project is a better bet than an anonymous IP address. The official guide's advice is your own node first, then a trusted remote node.
- Tor or onion. A .onion node hides your IP from the operator. If you must use clearnet, choose a node with HTTPS so the connection is at least encrypted in transit.
- Not on the ban list. Check the node's IP address with the spy node checker.
Our live remote node list shows height, 24-hour uptime, latency and HTTPS for each node. On 11 November 2026 it listed 175 clearnet nodes, 166 of them synced, and 129 .onion nodes, 95 of them online. Bookmark two or three so you have a fallback.
How to set a remote node in your wallet
Monero GUI
Custom remote nodes need Advanced mode. Check under Settings > Info > Wallet mode. To switch, close the wallet (Settings > Wallet > Close this wallet) and click Change wallet mode on the welcome screen. Then open Settings > Node, select Remote node, enter the address and port, and connect. For a node listed as example.org:18089, the address is example.org and the port is 18089. These steps follow the official user guide. The current release is 0.18.5.4.
Feather Wallet
Feather connects by default to a random node from a curated list run by community members. Change this under Settings → Network → Nodes, where you can add your own. Tor behavior is under Settings → Network → Proxy with three modes: never, switch to Tor after initial synchronization (the default), or always. By default Feather broadcasts transactions over Tor, according to its documentation.
Cake Wallet
In Cake Wallet, open Settings from the top right, tap your Monero wallet's coin settings, then Nodes. Tap a preset to switch, or tap + to add a node with its address, port and the Use SSL toggle. The docs say to turn on Trusted only for a node you control. Built-in Tor is under Settings → Connections → Enable built-in Tor, and Cake still labels it experimental. Turning it on does not change your node, so select the "Cake Wallet (Tor)" onion node afterwards. Cake Wallet pays for a placement on XMRList; grades are never affected by payment.
Monerujo
In Monerujo, the node display sits above your wallets on the wallet list screen. Tap it to open the node list, pull down to scan the network, or tap Add Node and enter the hostname or IP and port. The app's help text suggests bookmarking three to five nodes so it can pick the fastest. Tor needs the Orbot app; enable it with the network icon on the wallet list screen. Monerujo's latest release is 4.1.7, from June 2025.
Spy nodes and the MRL ban list
Spy nodes are a related but separate problem. They sit in Monero's peer-to-peer network, between nodes, and behave in ways normal nodes do not. The concern is that an operator running many of them can try to work out which IP address first broadcast a transaction.
The Monero ban list maintained by Boog900 collects these addresses. The current file is headed "Monero Research Lab spy node ban list version 2", dated 10 December 2025 and added to the repository on 11 January 2026. It has 431 entries: 417 single addresses and 14 ranges. The repository includes signatures from several Monero contributors so you can verify the file.
The list is for people who run a node. Start monerod with --ban-list /path/to/ban_list.txt, and consider --enable-dns-blocklist for the DNS-based list managed by Monero contributors. Neither is on by default.
If you only use a remote node, the list still tells you something: do not use a node whose IP is on it. On 11 November 2026 none of the 175 clearnet nodes in our list resolved to a banned address. A clean result is not proof of honesty, though. Any remote node sees your IP unless you use Tor.
Your own node vs a remote node
| Setup | Disk today | What others learn | Effort |
|---|---|---|---|
| Own full node | About 280 GiB | Nothing about your wallet | Initial sync on an SSD, then leave it running |
| Own pruned node | About 93 GiB (estimate) | Nothing about your wallet | Same, on a smaller disk |
| Remote node over Tor or .onion | None | Operator sees your transactions and timing, not your IP | Low; syncing is slower |
| Remote node on clearnet | None | Operator sees your IP, timing and transactions | Lowest |
The full figure is what public nodes reported on 9 November 2026. Nodes round it up in 5 GiB steps, so treat it as an upper bound. The monerod documentation says pruning saves about two thirds of disk space, which puts a pruned node at around a third of the full size. See Monero blockchain size for the current numbers.
A pruned node gives your wallet the same privacy as a full one. If you have a spare mini PC or a desktop that is usually on, the setup is covered in how to run your own Monero node.
Troubleshooting connection failures
- Wrong port or SSL setting. Cake Wallet's docs call this the most common mismatch: SSL switched on for a non-SSL port, or the reverse. Monero's default RPC port is 18081; many public nodes use 18089 or 443.
- The node is down or behind. Switching nodes is the first fix to try. Compare the node's height with the network tip before blaming your wallet.
- Onion node without Tor. A .onion address only connects while Tor is running. In Cake, enable built-in Tor; in Monerujo, start Orbot.
- Feather cannot connect after an update. The 2.9.1 release notes (2 November 2026) say the built-in Tor daemon shipped with the previous release was deprecated. Update to 2.9.1, install Tor system-wide, or turn Tor off in Feather.
- Monero GUI has no remote node option. The wallet is in Simple mode. Switch to Advanced mode as described above.
- "Node version incompatible" in Monerujo. Monerujo shows this when the node does not match the version the app expects. Update the app or try another node.
- Balance looks wrong or shows zero. Your funds are on the blockchain, not on the node. Connect to a synced node and let the wallet finish scanning.
You can also reach XMRList itself over Tor; the onion address is on our Tor page.
FAQ
Can a remote node steal my Monero?
No. The node never receives your keys or seed, so it cannot move funds. The risk is metadata: your IP address and the transactions you broadcast through it.
Can a remote node see my balance?
No. Your wallet downloads blocks and checks them locally with its own keys, so the node cannot tell which outputs belong to you or how much you hold.
What port does a Monero remote node use?
The default RPC port is 18081. Many public nodes offer restricted RPC on 18089, and some use 443 with HTTPS. Always copy the port shown next to the node's address.
Does Tor fix the privacy problem of remote nodes?
It hides your IP address from the node, which is the main leak. The node can still see the transactions you submit and when, so your own node remains the stronger option.
What is the MRL ban list?
A signed list of IP addresses and ranges suspected of being spy nodes, published in the Boog900/monero-ban-list repository. Version 2 has 431 entries, and node operators load it with the --ban-list option.
