Monero Address

Detects Monero (XMR) public addresses, encoded in Monero-specific base58 (same 58-character alphabet as standard base58, excluding 0 O I l). Standard addresses (mainnet network byte 18) and subaddresses (network byte 42) are 95 characters and begin with "4" or "8"; integrated addresses (network byte 19, standard address + encrypted 64-bit payment ID) are 106 characters and begin with "4". The fixed 95/106-char length is highly distinctive, gated at 85. Prefixes/lengths verified against the Monero standard-address and integrated-address docs.

Type: regex
Engine: universal
Confidence: medium
Confidence justification: Gated 85: the fixed 95-char (standard/subaddress) or 106-char (integrated) length with a 4/8 leading character is a very distinctive envelope that essentially never occurs by chance, so it earns the high tier — but only when AND-gated by cryptocurrency/wallet domain context plus the noise exclusion. The Monero checksum cannot be validated in a Purview-safe regex, so context gating is retained rather than exporting a bare tier.
Jurisdictions: global
Regulations: FATF Recommendations, AML/CTF Act (Cth)
Frameworks: ISO 27001, ISO 27701, SOC 2
Data categories: financial
Scope: narrow
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

\b(?:4[1-9A-HJ-NP-Za-km-z]{94}(?:[1-9A-HJ-NP-Za-km-z]{11})?|8[1-9A-HJ-NP-Za-km-z]{94})\b

Corroborative evidence keywords

identifier, number, ID, transaction, transfer, payment, deposit, withdrawal, debit, credit, data record, database record, record set, data extract, data export, database table, spreadsheet, data registry, registry entry, master data (+14 more)

Proximity: 300 characters

Should match

4AdUndXHHZ6cfufTMvppY6JwXNouMBzSkbLYfpAV5Usx3skxNgYeYTRj5UzqtReoS44qo9mtmXCqY45DJ852K5Jv2684Rge — Standard address (network byte 18, "4" prefix) from the Monero standard-address docs (95 chars)
4LL9oSLmtpccfufTMvppY6JwXNouMBzSkbLYfpAV5Usx3skxNgYeYTRj5UzqtReoS44qo9mtmXCqY45DJ852K5Jv2bYXZKKQePHES9khPK — Integrated address (network byte 19, "4" prefix, + payment ID) from the Monero integrated-address docs (106 chars)
888tNkZrPN6JsEgekjMnABU4TBzc2Dt29EPAvkRxbANsAnjyPbb3iQ1YBRk1UXcdRsiKc9dhwMVgN5S9cQUiyoogDavup3H — Address with the 8 prefix (95 chars) from the Monero moneropedia address page (documented example)

Should not match

5AdUndXHHZ6cfufTMvppY6JwXNouMBzSkbLYfpAV5Usx3skxNgYeYTRj5UzqtReoS44qo9mtmXCqY45DJ852K5Jv2684Rge — Wrong prefix (starts with 5, not 4 or 8)
4AdUndXHHZ6cfufTMvppY6JwXNouMBzSkbLYfpAV5Usx3skxNgYeYTRj5UzqtReoS44qo9mtmXCqY45DJ852K5Jv2684Rg — Too short (94 chars — one below the fixed 95)
4AdUndXHHZ6cfufTMvppY6JwXNouMBzSkbLYfpAV5Usx3skxNgYeYTRj5UzqtReoS44qo9mtmXCqY45DJ852K5Jv2684RgeX — Too long (96 chars — neither 95 nor 106)
4AdUndXHHZ6cfufTMvppY6JwXNouMBzSkbLYfpAV5Usx3-skxNgYeYTRj5UzqtReoS44qo9mtmXCqY45DJ852K5Jv2684Rge — Hyphen breaks the run so no contiguous 95/106-char body exists — rejected
monero wallet address example placeholder — Template/placeholder context should be excluded even when domain anchor words are present

Known false positives

The fixed 95/106-char base58 envelope with a 4/8 leading character is extremely distinctive, but the Monero checksum cannot be validated in a Purview-safe regex, so a crafted string of the exact length, prefix and charset would still match structurally. Mitigation: The tier is AND-gated by cryptocurrency/wallet domain context (crypto-wallet-context) within the proximity window plus a template/sample noise NOT-group. The distinctive length keeps the residual collision rate negligible.

References

Collections

Cryptocurrency Wallet Addresses