Taproot Explained: How Bitcoin's Quietest Upgrade Works

On November 14, 2021, at block height 709,632, Bitcoin quietly changed. No downtime, no fork, no drama. Most people who owned bitcoin that day never knew anything happened. Taproot — the network's first consensus upgrade since SegWit in 2017 — went live, and the price didn't move. That non-event is arguably the most impressive part of the story: a $2 trillion monetary network upgraded its cryptography without a single user needing to do anything.

Nearly five years later, Taproot is still misunderstood. It gets described as a “privacy upgrade” or a “smart contract upgrade,” both of which are half-true and mostly unhelpful. Here's what it actually does.

The problem Taproot was built to solve

Before Taproot, every bitcoin transaction wore its spending conditions on the outside. If you spent from a 2-of-3 multisig vault, the blockchain recorded that it was a 2-of-3 multisig, showed all three public keys, and published both signatures. If you spent from a Lightning channel, the on-chain footprint looked different from a normal payment. If you had a wallet with a complex inheritance timelock, that structure was permanently visible to anyone with a block explorer.

This was bad for three reasons. It leaked information about who you are and how you hold your coins. It was expensive, because every extra key and signature is extra bytes and bytes cost sats. And it made complex setups a form of self-doxxing — the exact people most likely to need a multisig vault were the ones broadcasting that they had one.

Taproot's core insight: most of the time, everybody agrees. If all parties to a contract cooperate, the transaction should be indistinguishable from any other transaction on the network.

Schnorr signatures and the magic of adding keys together

The engine underneath Taproot is a signature scheme called Schnorr, specified in BIP 340. Bitcoin originally used ECDSA, which Satoshi chose in 2008 partly because Schnorr was still under patent until 2008 and ECDSA had an established open implementation in OpenSSL.

Schnorr signatures have a property ECDSA lacks: linearity. Two public keys can be added together to produce a third valid public key, and the corresponding two signatures can be added together to produce one valid signature for it. This is the whole ballgame.

It means a 3-of-3 multisig can be collapsed into what looks, on-chain, like a single key with a single signature. Protocols like MuSig2 let a group of signers interactively produce one aggregate signature. A corporate treasury with a five-key setup and an individual with a phone wallet can produce transactions that are byte-for-byte identical in structure. The chain surveillance firms that build their business on clustering heuristics lose a data source.

Schnorr signatures are also fixed at 64 bytes, versus roughly 71–72 bytes for a DER-encoded ECDSA signature. Small, but it compounds across a multisig where you'd otherwise be publishing several.

Key path, script path, and hiding the branches you didn't use

Taproot itself — BIP 341 — combines Schnorr with a structure called a Merkelized Alternative Script Tree, or MAST. A Taproot output commits to two things at once: a single public key (the key path) and a Merkle tree of alternative spending conditions (the script path).

Say you build a wallet with three rules: you and your partner can co-sign at any time, or after one year your partner can spend alone, or after five years your daughter's key can recover the funds. Under the old rules, spending it published all three rules. Under Taproot, if you and your partner just co-sign normally, the transaction reveals only that path. The other two branches are never disclosed — not obscured, not encrypted, simply never written to the chain. And if you do need a fallback branch, you reveal that one branch and its Merkle proof, not the entire tree.

The third piece, BIP 342 or Tapscript, updated Bitcoin's scripting language to work with the new signature type and removed some legacy limits, like the 10,000-byte script size cap.

Why adoption is still under a quarter of transactions

Here's the unglamorous part. Taproot outputs use bech32m addresses beginning with bc1p, distinct from SegWit v0's bc1q. As of 2026, Taproot accounts for roughly 15–20% of transaction activity. SegWit v0, by comparison, has matured to somewhere around 90–95%.

Worse, a chunk of the Taproot usage that did happen wasn't the privacy-preserving kind at all. Taproot adoption spiked above 40% in early 2024, and the driver was Ordinals inscriptions and Runes stuffing data into Taproot's expanded witness space — the opposite of the lean, indistinguishable transactions the upgrade was designed for. When that speculative wave cooled, so did the numbers.

Organic adoption is slow because upgrades in Bitcoin are opt-in by design. Exchanges have to add withdrawal support. Wallets have to change their default address type. Every business with hardcoded address validation has to update it. Nobody can force it, which is exactly the property that makes Bitcoin worth using.

What you can actually do about it

Check your wallet's address type. Open the receive screen and look at the first four characters. If you see bc1p, you're on Taproot. If you see bc1q, you're on SegWit v0 — still fine, still cheap, but you can usually switch in settings by adding a new Taproot account. If you see an address starting with 1 or 3, you're on legacy or wrapped SegWit and you're paying meaningfully more in fees than you need to.

Two caveats worth knowing before you switch. First, some older exchanges and services still can't send to bc1p addresses — test with a small amount first. Second, switching address types doesn't move your existing coins; your old UTXOs stay where they are until you spend them.

The broader takeaway is about how Bitcoin changes. Taproot took roughly four years from Gregory Maxwell's initial proposal in 2018 to activation, went through a signaling mechanism called Speedy Trial that locked in during June 2021, and shipped without breaking a single existing wallet. That's the cost of doing consensus changes on a network that settles trillions of dollars. Slow is the feature.

If you've read this far, you already care about the parts of Bitcoin most people scroll past. BitCloset makes heavyweight apparel for people who chose Bitcoin on purpose — priced in sats, printed in Connecticut, no logos borrowed from anyone else's chain.

Further reading

Back to blog

Leave a comment