Moderate risk — the Qubic mining pool's April 2026 exit removed the active 51% attack threat, and Ring Signature v3 deployment and FCMP++ audit progress indicate strong development momentum. Ongoing exchange delistings and the structural hashrate concentration vulnerability on CPU-minable RandomX offset these positives.
Risk Breakdown
Top Risks
In August-September 2025, the Qubic mining pool gained >51% of Monero's RandomX hashrate through its 'useful Proof-of-Work' dual-mining incentive, executing 6-block and 18-block reorganizations. Qubic exited Monero mining on April 1, 2026 following its transition to Dogecoin, removing the immediate threat. However, the underlying vulnerability persists: any future dual-mining scheme offering sufficient secondary rewards could repeat the attack on Monero's CPU-friendly RandomX algorithm.
Monero faced 73 exchange delistings in 2025, including restrictions from Binance and Kraken across parts of Europe, severely fragmenting centralized exchange liquidity. Mandatory privacy features make Monero a primary target for regulatory action. THORChain mainnet integration (targeted May-June 2026) and atomic swaps provide growing decentralized access alternatives.
Mandatory privacy (ring signatures, stealth addresses, RingCT) means all transactions are private by default, making supply auditability dependent on the cryptographic soundness of the privacy primitives. Unlike Zcash's opt-in privacy, there is no transparent fallback to verify total supply.
FCMP++ (Full-Chain Membership Proofs), which will replace ring signatures with ZK proofs and expand the anonymity set from 16 to 150M+ outputs, is in beta stressnet phase with a Trail of Bits audit scheduled May 11-22, 2026. Until FCMP++ deploys to mainnet (targeted mid-2026), the existing ring signature privacy model remains in production.
Frequently Asked Questions
Is Monero safe to use?
What are the main risks of using Monero?
What is Monero's risk score breakdown?
How does Monero compare to other L1 protocols?
Has Monero ever been hacked or exploited?
Get risk alerts before it's too late
Weekly grade changes, downgrade alerts, and new protocol risk findings. Free.