Monero's privacy architecture relies on three fundamental tools that operate independently to protect transaction data. Ring signatures hide the sender by using a ring of 16 members where the output being spent is combined with decoys from the blockchain, making each input point to 16 possible sources with only one being real. Stealth addresses hide the receiver through the creation of one-time addresses for each payment, ensuring two payments to the same published address appear unrelated to outside observers. RingCT hides the amount through confidential transactions that have been mandatory since September 2017, with every transaction showing only unknown amounts on block explorers. Since the v15 upgrade at height 2,688,888 on August 13, 2022, every ring has exactly 16 members as a consensus rule, with the ring size shown as a dated constant from the Monero README rather than measured.
Early research studies revealed significant privacy weaknesses in Monero's system. A 2017 study by Kumar and colleagues identified the real output being spent in 87% of cases they analyzed. A 2018 paper by Möser and colleagues found that many early inputs had no decoys at all, allowing researchers to rule out spent coins in other rings and determining that the newest ring member was typically the real one. Most of these issues were addressed through protocol improvements, including minimum ring sizes that ended spends without decoys, RingCT inputs becoming largely immune to chain reaction effects, and wallets now selecting decoys using the same spending-time curve as the 2018 study measured.
The FCMP++ upgrade introduces Full-Chain Membership Proofs combined with spend authorization and linkability, fundamentally changing how Monero transactions are structured. Instead of hiding spends among 16 ring members, transactions will prove they spend one of all spendable outputs on the chain, which developers estimate at more than 150 million outputs. For users, this will result in larger anonymity sets, larger transactions, wallets requiring chain re-scans, and no more custom unlock times on new transactions. A new addressing protocol called Carrot ships with FCMP++, providing protection against Janus address-linking attacks and the burning bug while maintaining compatibility with existing standard addresses and subaddresses. The upgrade is currently being tested on public test networks with the latest stressnet release being v0.19.0.0-beta.3.0 (September 25, 2026), and the fcmp++ hf milestone had 31 of 42 issues closed as of October 23, 2026, with no due date set.
The FCMP++ upgrade is currently testing on the public beta stressnet but not live on mainnet. According to a developer's draft plan, a first fork-enabled release was penciled in for October 14-21, 2026, with a fully featured release including hardware wallet and multisig support planned for early December 2026. However, the developer calls this timeline non-binding, and as of October 23, 2026, getmonero.org has not announced a fork-enabled release. Currently, 42 projects are tracking FCMP++ development, with 0 ready, 3 in test release, 11 in progress, and 28 with no public statement. The README's upgrade table lists no mainnet height for FCMP++ implementation.
Until FCMP++ implementation, users can maintain privacy through several practices. Maintaining XMR in wallets under personal control prevents services from associating addresses with accounts, while using new subaddresses for each payer prevents payers from identifying common recipients. Running own nodes or accessing them through Tor or I2P prevents remote node operators from seeing transaction IP addresses, and avoiding mirror-image payments with consistent amounts and timing differences helps prevent linking. Swapping through services like HiddenSwap allows anonymous BTC-to-Monero swaps without account requirements, ensuring transaction records contain no names or IP addresses. The upgrade is expected to take each input from an immediate anonymity set of 16 to approximately 100 million, significantly expanding privacy protection.
