RingCT and FCMP++ in plain words
What exists today, what will change, and why this is Monero's biggest upgrade
RingCT (today): your real input is hidden among 15 random inputs of other people. Amounts and recipients are fully hidden; the sender is "one of 16".
FCMP++ (soon): your real input is hidden among all outputs ever created on Monero. Decoys are no longer needed, and most attacks on them disappear.
What exactly RingCT hides
RingCT isn't one technology but a bundle of three. Importantly, two of the three already work great today, and FCMP++ barely touches them:
| Question | Hidden by | How well |
|---|---|---|
| How much? | Pedersen commitments + Bulletproofs+ | Fully. Amounts are visible to nobody but the parties. |
| Who received? | One-time addresses | Fully. Your address never reaches the blockchain. |
| Who sent? | Ring signatures (16 members) | Partially. "One of 16" is a probability, and it can be narrowed. |
The weak link is the third row. That is exactly what FCMP++ replaces.
How a ring works — the intuition
To spend a coin you must prove it's yours. Monero says: "don't show which coin is yours. Take 15 other coins from the blockchain and prove that one of these 16 is yours."
Your wallet picks decoys randomly, but not uniformly: recent outputs are picked more often, because people tend to spend recent money. If decoys were uniformly "old", the real input would stand out by its youth.
RingCT: pros and cons
+ Strengths
- Amounts and recipients are hidden fully and reliably.
- Privacy is mandatory for all transactions — the crowd is large.
- Cryptography proven over years (CLSAG, Bulletproofs+), with audits.
- Relatively compact transactions (~1.5–2 KB for a typical 2-in/2-out) that verify fast.
- Each transaction on its own gives plausible deniability: "it may not have been me".
− Weaknesses
- The anonymity set is just 16. That's small if an adversary can rule candidates out.
- Exclusion attacks: if an adversary knows a decoy was really spent elsewhere (or is their own), the circle shrinks.
- EAE attack: an exchange that saw money go "there and back" can link input and output with high probability.
- Flooding: someone mass-creates their own outputs, which become your decoys — "empty" ones for them.
- Bugs in decoy selection (there have been some) make the real input statistically visible.
- Many inputs in one transaction (consolidation) — a visible link between rings.
Each weakness is covered in detail on the RingCT weaknesses page.
What FCMP++ changes
FCMP++ stands for Full-Chain Membership Proofs. The "plus-plus" is because something more is added to the membership proof (see below).
The idea: instead of "my output is one of these 16", a transaction proves "my output is one of all outputs on the blockchain" — without listing them. How, with over a hundred million outputs? All outputs are gathered into a special tree (similar to a Merkle tree — a Curve Tree) with a single root. The transaction proves in zero knowledge: "I know a path from some leaf to this root, and I hold the key to that leaf."
RingCT: "the money was given by one of these 16 people in the room". An investigator can question them one by one and cross out those with alibis.
FCMP++: "the money was given by someone living in the country". Crossing people out is pointless.
What else comes with FCMP++
- No decoys, no decoy problems. Flooding, EAE attacks and input-age statistics practically lose their meaning.
- Forward secrecy. If a quantum computer able to break elliptic curves appears one day, it could forge new transactions but could not retroactively reveal which outputs were spent in old FCMP++ transactions (as long as the recipient's address wasn't public). This applies to outputs created after the switch; old RingCT outputs don't get this protection.
- A new addressing scheme, Carrot: old addresses keep working, but new key types appear — for example a key that sees both incoming and outgoing payments (an honest view-only wallet) without the right to spend.
- Groundwork for the future: simpler multisig, transactions that can be signed in advance.
FCMP++: pros and cons
+ Pros
- The anonymity set is the whole blockchain (orders of magnitude more than 16).
- Decoy-based attacks disappear.
- Quantum forward secrecy for spend history.
- Better view-only wallets and permission separation (Carrot).
- Existing addresses and seed phrases keep working.
− Cons and costs
- Transactions are larger and slower to verify than RingCT (especially with many inputs).
- New, complex cryptography: new curves (Helios/Selene), new proofs. Audits are needed; mistakes are costlier.
- Building a transaction is heavier for weak devices and hardware wallets.
- Nodes must maintain a tree of all outputs.
- Doesn't solve off-chain problems: IP addresses, metadata, user behaviour.
What changes for an ordinary user?
Almost nothing visible. After the hard fork, wallets will start creating the new transaction type. Your seed phrase and addresses keep working. Fees may rise a little because of transaction size. Old coins can be spent — and they also get "the whole blockchain" as their anonymity set.
FCMP++ requires a hard fork. As of November 2026 it is not yet active on mainnet: public testing is under way, and a non-binding draft plan targets activation in early 2027. More in migrating to FCMP++.
Where next
- Ring signatures — how "one of 16" works mathematically.
- RingCT weaknesses — in detail, with examples.
- FCMP++ — technical overview.