Before I go deeper into technical details regarding important aspects of Carrot with further posts, I present you, as something like an "interlude", a history of Monero privacy technologies. One aim is to show you how we arrived at the point where we are now with FCMP++ and Carrot. It's also an already quite long and IMHO interesting history that is worth to be told as part of this post series. (You find part 1 here.)
CryptoNote pure (2014)
Monero started a new blockchain in 2014 with code forked from Bytecoin, initially running unmodified CryptoNote technology as far as "privacy tech" was concerned.
Stealth addresses were already hiding receivers, in the same way they still are today. Ring signatures were already hiding, or better obfuscating, senders. The ring size was not fixed until a hardfork in 2018 however; transactions with 3, 10 or even zero decoys and thus no sender hiding were possible, and also actually occurred.
It may surprise that transaction amounts were still fully visible in the blockchain back then. Have a look at what is claimed to be the Monero transaction with the largest known amount, from July 17, 2017, for more than XMR 500,000, corresponding to a fiat value of over USD 100 million today. If you scroll down the linked block explorer page to the 117 inputs(s) for total of 506510.898899999971 xmr heading, you can see that the ring size is 0: All the enotes that contribute to the total amount are in the clear, without any need to guess.
Bytecoin is still running by the way, using the unmodified CryptoNote technology described here to this day, as you can see at their block explorer.
RingCT (2015)
Although nothing was ever actually deployed to the Bitcoin blockchain, various people discussed enhancing privacy quite early on. As this article from Binance details, already 2013 somebody came up with the basic idea for a scheme called Confidential Transactions, abbreviated as CT, to hide transaction amounts. Bitcoin Core dev Greg Maxwell refined this in 2015 and published a description, still available via Archive.org here.
Also still in 2015 somebody with the pseudonym Shen Noether, a member of the Monero Research Lab (MRL), adapted CT for Monero and named it Ring Confidential Transactions, or RingCT for short; see the published paper as a PDF file here.
When Monero hardforked to use RingCT in 2017, all its 3 basic privacy mechanisms were in place, hiding receivers, hiding senders and hiding amounts. Monero introduced ring signatures that were smaller and allowed faster verification than the original CryptoNote ones in 2020 called CLSAG, but this changed nothing fundamental: As of now, in Spring 2025, the technology established with the 2017 introduction of RingCT is still what powers the Monero blockchain.
Triptych (2020)
While stealth addresses and RingCT are basically unassailable and may stand firm indefinitely into the future, or at least until working quantum computers arrive, ring signatures are less solid in comparison, and were known to have some weaknesses early own. It's therefore not surprising that further attempts to improve Monero's privacy technologies centered on them.
It's quite obvious that the larger the rings, the better the privacy and protection against statistical attacks that they offer. That's the main reason why the mandatory ring size for Monero transactions stands now at 16, quite some step up from 11 established in 2018. Obvious idea: Switch to still larger rings. How about, for example, rings of size 128? Or why not 1024 while we are at it?
The problem: While these would be possible in theory, with the current cryptography that Monero uses they are not really feasible. Transactions would swell to an enormous size.
A few numbers to illustrate: This transaction from 2021 has ring size 11 and a size of about 1.9 kB. This recent transaction from 2025 has ring size 16 and is 2.2 kB. This transaction from a Monero fork called Wownero but quite comparable has ring size 22 and is already 2.5 kB.
Around 2020, the MRL members Sarang Noether and Brandon Goodell worked out an alternative scheme that they called Triptych. See the announcement on Reddit here and the published academic paper here.
Advanced cryptography often looks a bit like magic, like in this case. With Triptych, the byte size of a transaction scales logarithmically with the ring size. A ring size 512 transaction with 2 inputs and 2 outputs would be only 3.4 kB, and a mere 0.2 kB more would allow you to double the ring size to 1024!
This blockchain explorer screenshot shows a 2/2 Triptych transaction with ring size 128 in all its glory. Yes, Triptych was implemented and reached an early beta stage.
Unfortunately it turned out that multisig transactions would be awfully complicated to implement with Triptych and laborious to handle for users. See e.g. this report with an analysis.
When an alternative scheme was presented with basically the same benefits as Triptych but much simpler multisig the latter was finally abandoned.
Seraphis and Jamtis (2021)
This alternative is called Seraphis and was worked out by a cryptographer with the pseudonym koe. See e.g. this blog post on the getmonero.org website. Seraphis allows for large ring sizes like 128 with reasonable transaction sizes and also reasonable verification times, plus it makes a simple multisig implementation possible.
Seraphis was intended to come together with Jamtis. That's a so-called addressing protocol: Like Carrot that I described in my first post, it defines which keys secret and public there are, how they allow wallets to work and how Monero addresses look with them. It was developed by a cryptographer with the pseudonym Tevador who already came up with RandomX, Monero's current "ASIC busting" proof-of-work algorithm. They originally published the specification here.
There is one significant drawback of this duo of technologies compared to Triptych: The current 95-character CryptoNote style addresses would become invalid, and much longer brand new addresses would take their place. See my 2022 Redit post Why Seraphis / Jamtis addresses will be so awfully long, and what we will get from those for a detailed story.
Never mind addresses with a length of 200 characters or even more: Moving a whole community of cryptocurrency users the size of Monero's over to completely new addresses for each and every wallet is a large and complicated endeavor in any case.
Nevertheless for quite some time the majority of Monero devs assumed that Seraphis and Jamtis would indeed be the future Monero technologies, and people went to work. Over the course of about a year and paid by the Monero community through the CCS koe himself implemented Seraphis in the form of a beautifully architected and solid library, and a group of devs called the Seraphis wallet workgroup started to implement, as you can guess from the workgroup name, a new wallet component as part of the Monero core software.
FCMP++ (2023) and Carrot (2024)
What cryptographer and dev kayabanerve first presented at MoneroKon 2023 is in a way a much more radical approach to improve sender privacy for Monero than both Triptych and Seraphis are. Instead of merely making larger rings, it gets rid of them altogether. As I wrote in my first post: "Until now, if you spend XMR, you hide among 15 other people doing so. With FCMP++ you hide among all the people who ever did an XMR transaction since Monero's genesis in 2014."
This blogpost on the GetMonero.org website explains that the original plan was to deploy full-chain membership proofs with a second hardfork after the one to "original" Seraphis, or in the best of all cases together with Seraphis in a single hardfork, after delaying that hardfork a bit to make that possible. But then something happened that would change the course of Monero history, so to say:
In March 2024 the Monero network was flooded with hundreds of thousands of additional transactions. Daily Monero transaction volume suddenly more than tripled, which is hard to explain as just a sudden surge of Monero use for some reasonable and legit reason. It was speculated that a single adversary was basically spamming the Monero blockchain with their transactions, with the purpose of this attack unknown. One possible purpose: Getting to know as many enotes as possible to weaken Monero's sender anonymity. The basic approach: If I can recognize on average, say, 10 of the enotes making up the rings of your transaction as mere decoys, because I all made them myself, your protection is down to a ring size of about 6.
You find an interesting explanation of this, together with plenty of fascinating charts, in the report of Monero's resident statistics researcher Rucknium here. The average effective ring size was indeed down to about 5.5 during the attack.
In the light of all this the Monero dev community came around to agree that rings had to go, and had to go quickly. kayabanerve managed to modify this full-chain membership proof technology to run independently of Seraphis instead of "on top of it" and named it FCMP++.
A bit later jeffro256 developed Carrot as a clever way to get almost all benefits of Jamtis but without the need to push everybody through a painful address format change, which made it more acceptable still to put Seraphis and Jamtis aside and go "all in" on FCMP++.
Possible futures
If we look a few years into the future, what kind of base technologies for Monero could come after FCMP++ and Carrot?
One possibility is to stop all attempts to improve using "conventional" cryptography and try to figure out how to build a completely quantum-computer-proof cryptocurrency that is both fully private and feasible regarding key sizes, transaction sizes and transaction processing times. That would probably not be easy, and might depend on advances in post QC cryptography in general that don't exist yet right now but are yet to come. Still, it may be worth it.
Conclusion
With FCMP++ and Carrot, for the second time in a row already after Triptych and Seraphis plus Jamtis, something still better came along, interesting technology and a considerable amount of work done were put aside, and the Monero roadmap rewritten. You may very well doubt the wisdom of doing such abrupt and wasteful changes of direction, but I guess this is to be expected in a field that is developing as quickly as cryptocurrency related cryptography, at least if you decide to go with the times and improve instead of working with something that was more or less frozen in 2009 like Bitcoin does.
https://files.catbox.moe/0kz3s3.webp
