FCMP++: where Monero's biggest privacy upgrade stands
FCMP++ replaces Monero's 16-member ring with a proof over every output on the chain, taking the anonymity set from 16 to about 100 million. It is in testing. Mainnet is still on v16.
FCMP++ is the next planned change to how Monero hides the sender of a payment. FCMP stands for Full-Chain Membership Proofs.
Today each input hides the real coin among 15 decoys, a ring of 16. FCMP++ proves the real coin is one of every output ever made, without showing which one. The pool of possible senders jumps from 16 to about 100 million.
How a spend is hidden today
Every input picks 15 old outputs as decoys and signs across all 16 with a ring signature. The current scheme is called CLSAG. One of the 16 is the coin being spent, and an outside observer cannot tell which.
The ring is small and fixed, so research has found ways to narrow it. Timing, reused outputs, and the EAE pattern (a known output, then Monero, then another known output) all chip away at the guess.
What FCMP++ changes
FCMP++ drops the ring. Instead of naming 15 decoys, a spend carries a zero-knowledge proof that its coin sits somewhere in the full set of outputs. The proof shows membership, not position. Every input then draws from the same pool: the whole chain.
The proof is built on curve trees. Every output is committed into a tree over two paired curves, Helios and Selene. Eagen's work on elliptic-curve divisors keeps the proof small and quick to check. The "++" folds in spend authorization and linkability, so the change no longer waits on the larger Seraphis rework.
Three things stay the same:
- Amounts stay hidden by RingCT.
- Receivers stay hidden by one-time stealth addresses.
- The key image, the marker that stops a coin being spent twice, works as before.
| Today (v16) | After FCMP++ | |
|---|---|---|
| Decoys per input | 15 (ring of 16) | every output on the chain |
| Anonymity set | 16 | about 100,000,000 |
| How membership is proven | ring signature (CLSAG) | curve-tree proof |
| Double-spend marker | key image | key image (unchanged) |
| Amounts and receivers | hidden | hidden |
Where it stands
FCMP++ is in development and testing. It is not on mainnet.
The code runs on a stressnet, a throwaway network built to load-test the proofs. A second, beta stressnet went live on 6 May 2026, and Trail of Bits audited the FCMP++ integration that month (11–22 May 2026). Carrot, a new address and output format, is being audited alongside it and ships at the same fork.
The second testnet (beta stressnet) for Full-Chain Membership Proofs (FCMP++) and CARROT will go live on May 6! We implore the Monero community to participate in testing and to report issues in order to ensure a smooth transition!
There is no fork date and no block height. Any figure you see is a target set by the developers, not a promise.
Mainnet is still on v16
Monero has not forked since August 2022. That upgrade set the ring size to 16 and added Bulletproofs+ and view tags. The protocol version has read v16 ever since. You can confirm it against any node:
$ curl http://YOUR_NODE:18081/json_rpc \
-d '{"jsonrpc":"2.0","id":"0","method":"hard_fork_info"}'
"result": {
"version": 16,
"enabled": true
}Our explorer reads the same value live. If it ever shows a higher number, the fork has landed.
What it means for you
There is nothing to do now. A fork this size is announced months ahead so wallets and exchanges can update.
Your coins carry over untouched. Because key images do not change, there is no migration and no window where old coins stop working. When wallets update, your spends start using the larger pool on their own.
The live protocol version is on the hard-fork status page and in the explorer. It reads 16 until the fork lands.
Sources
- FCMP++ hard-fork milestone — monero-project on GitHub
- Trail of Bits FCMP++ cryptography audit — MAGIC Grants
- getmonero.org — the official Monero project site
MoneroHelp is free, ad-free, and runs on its own Monero node. A little XMR keeps it online.