FCMP++ explained: Monero after ring signatures

The problem with picking fifteen decoys

A ring only protects you if its decoys look like plausible spends. They are drawn from a fixed model of how people spend, and real behavior does not match the model. Rucknium’s OSPEAD research measured the gap: against the default decoy selection used since the August 2022 upgrade, the strongest statistical guess would identify the real spend about 23.5 percent of the time, an effective ring size near 4.2 rather than 16. A retuned distribution would bring that down to 7.6 percent, an effective ring of 13.2. Every number in that paragraph exists only because the protocol has to guess what typical spending looks like.

What a full-chain membership proof does instead

The spender stops naming candidates. The wallet proves instead, without revealing which, that the output it is spending belongs to the set of all outputs, committed to in a tree the whole network agrees on. The 2024 design write-up put the scale plainly: every input goes from an immediate anonymity set of 16 to 100,000,000. Attacks that depend on the ring lose their target, because there is no ring to analyze - the decoy distribution statistics above, elimination of members already known to be spent, the older EAE pattern. Attacks that never depended on rings are untouched.

What changes for you, and what does not

From a wallet’s point of view this is a transaction format change, and the design deliberately keeps the disruption small.

• Your existing addresses keep working; migration to new key structures is designed to be optional.
• Sending looks the same. The wallet builds a different proof and you never see it.
• Scanning still uses your view key. Amounts stay hidden by confidential transactions, destinations by stealth addresses.
• The change makes room for features such as outgoing view keys and transaction chaining, but the design post is explicit that wallet support for them lands later, to keep the fork small.
• Monero’s custom transaction unlock time is retired at the same fork, and a relay rule already blocks new transactions that set one.

Honest uncertainty about timing

There is no date, and the primary sources say so. The May 2026 post announcing the unlock-time deprecation states that it takes effect at the FCMP++ consensus fork, with no date currently set. The integration audit was proposed in April 2026, funded by community donations, and runs in three phases covering the cryptography, the curve-tree construction, and the consensus integration; the proposal itself puts mainnet readiness at the end of the third phase, with a beta stressnet running alongside. As of late July 2026 the released software line is 0.18.5.x and contains no consensus change.

How to check the status yourself

This subject attracts confident and wrong articles, several of which assert a mainnet activation that has not happened. Three checks settle it in about a minute.

• A consensus change ships in a release whose notes say so, on getmonero.org. A point release listing only bug fixes is not a fork.
• A network upgrade is announced with a fork height well in advance, because every node operator has to act on it.
• The audit phases are public and milestone-based. If they are not complete, the integration is not finished.

Common questions

What people usually want to know once the cryptography is out of the way.

• Is FCMP++ live? Not as of late July 2026, and no fork date has been announced.
• Do I need to move my coins? No. Existing addresses stay valid and key-structure migration is designed to be optional.
• Will transactions get bigger or slower? The proof replaces the ring signature rather than adding to it, but final sizes and verification costs depend on the implementation being audited. Treat any exact byte count you read today as provisional.
• Does this make tracing impossible? No. It removes a family of attacks on which output was spent. It changes nothing about what a counterparty who already knows your address knows, and nothing about network-level metadata.
• What happens to my old transactions? History stays as it is. The upgrade changes how new spends are proven, not how past ones were.