diff --git a/README.md b/README.md
index d9e4be8..3f711e1 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 Navi-compatible cheatsheets for security, privacy, and digital sovereignty.
 
-49 cheatsheets spanning offensive security, DFIR, privacy, encryption, system hardening, and cryptocurrency.
+50 cheatsheets spanning offensive security, DFIR, privacy, encryption, system hardening, and cryptocurrency.
 
 ## Installation
 
@@ -104,6 +104,7 @@ navi --best-match --query "ssh hardening" --print   # print top match, no TUI
 | File | Description |
 |------|-------------|
 | `monero.cheat` | Monero CLI wallet operations |
+| `monero-wallet-cli.cheat` | Monero wallet: keys, addresses, transfers, tx proofs |
 | `bitcoin.cheat` | Bitcoin Core CLI operations |
 | `anonymous-payments.cheat` | Private payments (Monero, Lightning, cash) |
 | `solidity.cheat` | Smart-contract auditing (Slither, Foundry) |
diff --git a/monero-wallet-cli.cheat b/monero-wallet-cli.cheat
new file mode 100644
index 0000000..0de0387
--- /dev/null
+++ b/monero-wallet-cli.cheat
@@ -0,0 +1,68 @@
+% monero, monero-wallet-cli, xmr, wallet, privacy, cryptocurrency
+
+# monero-wallet-cli holds your keys, tracks balance, signs txns; connects to a monerod node.
+# Practice on --stagenet (fake money) before mainnet. Always verify the download (GPG+hash) before running.
+
+# Create a new wallet (offline stagenet sandbox = fake money, zero risk)
+monero-wallet-cli --stagenet --offline --generate-new-wallet <wallet_file>
+
+# Open an existing wallet (use the BASE name, NOT the .keys file)
+monero-wallet-cli --stagenet --wallet-file <wallet_file>
+
+# Open and connect straight to a remote node
+monero-wallet-cli --wallet-file <wallet_file> --daemon-address <node>
+
+# Restore a wallet from the 25-word seed
+monero-wallet-cli --restore-deterministic-wallet
+
+# --- inside the wallet prompt ---
+
+# Connect to a node (remote nodes require acknowledging the spy-node risk)
+set_daemon <node> this-is-probably-a-spy-node
+
+# Sync with the daemon
+refresh
+
+# Show primary address
+address
+
+# Create a new labeled subaddress (use a fresh one per sender)
+address new <label>
+
+# List all addresses + per-subaddress balances
+address all
+
+# Re-label a subaddress later
+address label <index> <label>
+
+# Show keys (private + public) — never share the private spend key or seed
+viewkey
+spendkey
+
+# Show the 25-word recovery seed (write on paper, store offline)
+seed
+
+# Balance (unlocked balance lags ~10 blocks behind received funds)
+balance
+
+# Transaction history (green = confirmed, red = failed)
+show_transfers in
+show_transfers out
+
+# Send XMR (shows the fee, asks to confirm; ring signatures are automatic)
+transfer <address> <amount>
+
+# Send the entire balance to one address
+sweep_all <address>
+
+# Prove you sent a payment, privately (no payment ID needed)
+get_tx_proof <txid> <address>
+check_tx_proof <txid> <address> <signature>
+
+# Recheck which outputs are spent (needs a TRUSTED daemon)
+rescan_spent
+
+# Save session state and quit cleanly (always exit this way)
+exit
+
+$ node: echo -e "node.monerodevs.org:38089\nstagenet.xmr-tw.org:38081"