What was the Taproot upgrade?

What Taproot changed

A bitcoin payment normally carries a digital signatureDigital signature (ECDSA, Schnorr)Proof, made with a private key, that the owner approved a payment. Anyone can check it; practical forgery is infeasible under current assumptions., a code that only the owner of the coins can make and anyone can check. Since 2009 Bitcoin had used a signature method called ECDSA. Taproot added a second, Schnorr signaturesSchnorr signatureA kind of digital signature Bitcoin added with Taproot in 2021. Several people can combine keys so their joint signature looks like one person's., set out in BIP-340, the first of the three Bitcoin Improvement Proposals, or BIPs, that define the upgrade. They work with the same kind of keys as before, but each signature is a fixed 64 bytes, and they have a property BIP-340 calls linearity: several people can add their keys together into one shared key, which is called key aggregation, and then sign for it jointly. To anyone checking, the joint signature looks exactly like one person's.

BIP-341, Taproot itself, puts that to work. Coins can be locked to one key, which may be several people's keys combined, and also to a list of backup conditions, such as letting Bob spend them alone after a year. The list is stored as a Merkle tree, a way of fingerprinting a list so that any one entry can later be shown to belong to it without revealing the others. Developers had discussed the idea, known as MAST, since 2013, according to Bitcoin Optech, a non-profit group that publishes a weekly newsletter on Bitcoin development. If everyone agrees, the coins are spent with the key, the “key path”, and nobody can tell that backup conditions ever existed. If not, the spender takes the “script path”, revealing and meeting just one condition while the rest stay hidden. The aim, in BIP-341's words, was to “minimize how much information about the spendability conditions of a transaction output is revealed on chain”.

BIP-342 defines Tapscript, the version of Script, Bitcoin's small programming language, in which those backup conditions are written. It checks Schnorr signatures, replaces the old instruction for checking several signatures with one that suits them, and drops the old limit of 10,000 bytes on the size of a script. It also leaves room for later upgrades.

Coins locked under the new rules have addressesAddressA string of letters and numbers that tells someone where to send you bitcoin, a bit like an account number for one payment. that start with bc1p, written in a slightly changed format, Bech32m, set out in BIP-350, which catches some typing mistakes the older format could miss.

Where Taproot came from

Bitcoin's developers had wanted Schnorr signatures for years. They are named after the German mathematician Claus Peter Schnorr, whose US patent on the method ran until February 2010, a year after Bitcoin launched. In February 2016 Gregory Maxwell, a Bitcoin Core developer who had co-founded the Bitcoin company Blockstream, called one Schnorr-based idea, merging all the signatures in a transaction into one to save space, “a no brainer improvement that Bitcoin is almost sure to eventually adopt once implemented”. In the end Taproot left that idea out, because, BIP-341 says, it “interacts in complex ways with upgrade mechanisms”.

Taproot itself started over lunch. In January 2018 Pieter Wuille, a Belgian Bitcoin Core developer, ate at a diner in Los Altos, California, with Maxwell and Andrew Poelstra, a mathematician who later became Blockstream's director of research. “While I briefly had to leave the table, they had come up with a really cool idea to hide Merkle roots in P2PK-like outputs,” Wuille recalled on Twitter on the day Taproot locked in, three years later. In plainer words: tuck the list of backup conditions inside something that looks like an ordinary public key.

Maxwell set the idea out on 23 January 2018 on the bitcoin-dev mailing list, where Bitcoin's developers discuss changes. Almost any contract between a fixed group of people, he noted, can be settled by everyone simply signing; “Other branches would only be used where some participant is failing to cooperate.” With key aggregation, the everyone-signs case “can be made indistinguishable from a normal one-party signature, with no overhead at all”, using a new kind of signature check “which I call Taproot”. He summed it up: “So in the all-sign case there is zero overhead; and no one can tell that the contract alternative exists.”

Turning the idea into rules took two more years. “There were so many ideas, but we couldn't realistically include everything in one proposal,” Wuille wrote. In May 2019 he and three co-authors published the first drafts. One, Anthony Towns, had worked on the free operating system Debian since 1998 and on Bitcoin Core since 2017, according to Paradigm, an investment firm that began paying his salary in 2020. The other two, Jonas Nick and Tim Ruffing, were researchers at Blockstream who helped maintain libsecp256k1, the code Bitcoin Core uses to check signatures. The drafts became BIPs 340, 341 and 342 in January 2020, after review sessions organised by Towns and Bitcoin Optech. The BIPs also credit earlier designs, including Russell O'Connor's original MAST. In October 2020 the code was added to Bitcoin Core, the most widely used Bitcoin program, but switched off.

The argument over switching it on

Taproot was a soft forkSoft forkA change that tightens Bitcoin's rules, so nodes that haven't upgraded still accept the new blocks., a tightening of the rules that older software still accepts. That is only safe once most of the network enforces the new rules, so the usual method asks minersMinerA computer, or a pool of them, that bundles waiting transactions into blocks and secures the network, paid in new bitcoin and fees., who add new blocks, to signal that they are ready by setting a marker in each block they make. For the previous upgrade, SegWit, that had gone badly. In 2016 and 2017 miners' support “peaked far below the 95% threshold”, Bitcoin Optech recalls, and some users, who “felt miners were illegitimately delaying a useful new feature”, wrote BIP-148, a plan for their software to reject any block that didn't signal.

Hardly anyone objected to Taproot itself: Bitcoin Optech wrote in February 2021 that it “appears to be almost entirely desired”. The argument was over one setting, LockinOnTimeout, or LOT. If miners still hadn't signalled by the deadline, should nodesNodeA computer running Bitcoin software that checks every payment and block against the rules, and passes them on to others., the computers that check Bitcoin's rules, start rejecting their blocks (LOT=true), or should the attempt simply lapse (LOT=false)? Michael Folkson, who organised meetings about it in an online chat channel, summed up both sides, noting that about 90% of mining pools had already pledged support. For true: it “entirely eradicates the possibility (however unlikely) that Taproot fails to activate within a year”, and “Miner signaling is not voting for the changes, it is signaling readiness.” For false: “This is not 2017, this is not SegWit, there is no need to worry,” and if miners held out, waiting another year was the worst that could happen: “Even the worst case scenario is not a disaster.”

The deadlock broke in March 2021 with a compromise called Speedy Trial, suggested in the same chat channel by Russell O'Connor and written up for the mailing list by David Harding, a contributor to Bitcoin Optech. Miners would get about three months. If 90% of the blocks in any two-week stretch of 2,016 blocks signalled, Taproot would lock in, certain to switch on, but not until block 709,632, months later, so that everyone had time to upgrade. If not, the attempt would fail and the argument could start again. The aim, Harding wrote, was “to allow a taproot activation attempt to either quickly succeed or quickly fail”. Bitcoin Core 0.21.1, released on 1 May 2021, carried it.

Not everyone accepted it. By April 2021 some LOT=true supporters had released their own version of Bitcoin Core, called Bitcoin Core 0.21.0-based Taproot Client, Bitcoin Magazine reported. It was maintained by two people using the names Bitcoin Mechanic and Shinobi, and its best-known contributor was Luke Dashjr, a long-time Bitcoin Core developer who maintains another node program, Bitcoin Knots. It gave miners until late 2022 and would then have rejected blocks that didn't signal. As long as miners locked Taproot in during Speedy Trial, the two programs would agree.

Lock-in and the first Taproot payments

Miners locked it in within six weeks of signalling opening on 1 May 2021. On 12 June block 687,284, mined by the pool F2Pool, became the 1,815th block in its two-week stretch to signal: 90%, enough to lock Taproot in. “Following that, it will activate at block 709632, probably around mid-November 2021,” Wuille wrote that day, ending with a carrot emoji (a carrot is a kind of taproot).

At 05:15 UTC on 14 November 2021, F2Pool also mined block 709,632, the first under Taproot's rules, switching on what The Block called “the first major upgrade to the network's code since the introduction of Segregated Witness in 2017”. Yet the block held no Taproot payments, and nor did the next two, both from the pool AntPool, Folkson recorded on the mailing list.

Bitcoin Optech suggested that some pools might have been “falsely signaling readiness”, or choosing payments with older software. In F2Pool's case, 0xB10C, a developer who helped it investigate, found that its nodes weren't connected to any others that were passing Taproot payments along, mainly because of a custom change to how they picked their connections. F2Pool had upgraded only several weeks earlier: “This indicates that they were signaling without being ready,” he wrote.

The first Taproot payments came three blocks later, in block 709,635, mined by Foundry USA at 05:40 UTC. The very first, from a user called bitbug42, carried a note in an OP_RETURNOP_RETURNA payment output that stores data instead of paying someone. It can never be spent, so nodes don't track it as spendable. output: “I like Schnorr sigs and I cannot lie.” Wuille made the third, spending from addresses he had hunted for because they spelled words, such as one beginning bc1ptapr00tearly. With Maxwell's help, he had “searched 2.4 quadrillion keys in a week”, Folkson wrote.

How people used it

“The real work will be in the ecosystem of wallets and other applications adopting changes to make use of Taproot,” Wuille had written at lock-in. It came slowly. A few wallets and services were ready when Taproot switched on, Bitcoin Optech reported, including the wallet service BitGo and the Muun wallet, while Ledger's app, Ledger Live, offered it as an experiment. Bitcoin Core's own wallet could make Taproot addresses in new wallets from version 23.0, released in April 2022. A year after activation, in the 30 days to 13 November 2022, about 1% of Bitcoin transactions spent coins from a Taproot address, by our count of the daily figures on mainnet.observer, a statistics site run by 0xB10C.

Key aggregation needed a shared standard before wallets could use it. In 2022 Nick, Ruffing and a third author published one, MuSig2, as BIP-327. It lets a group who must all sign, one kind of multisigMultisig (multi-signature)A wallet whose coins need signatures from several keys, such as 2 of 3, so no single key can spend alone., make one joint key and one signature. Signatures like that, in BIP-340's words, “from a verifier's perspective, are no different from ordinary signatures”.

The Lightning NetworkLightning NetworkA network built on Bitcoin for payments through channels, without recording every payment as its own blockchain transaction., a system for fast payments built on top of Bitcoin, began to use it. In October 2023 the Lightning software LND added “musig2-based taproot” channels as an experimental option. Bitcoin Optech says they take up less space and improve privacy when the two sides close a channel by agreement.

The biggest use came from an unexpected direction. On 20 January 2023 the developer Casey Rodarmor released ord 0.4.0, software for “inscriptionsInscription (ordinals)Data, such as an image, written into a Taproot payment's witness and tied to one satoshi, so it lives on the blockchain.”: files such as pictures, written into a Bitcoin transaction and tied to a single satoshiSatoshi (sat)The smallest unit of bitcoin: one hundred-millionth of a bitcoin. 100,000,000 sats make 1 BTC., the smallest unit of bitcoin, so they can be collected and traded under the name Ordinals. They are stored on Taproot's script path. “Taproot scripts have very few restrictions on their content, and additionally receive the witness discount, making inscription content storage relatively economical,” ord's documentation explains. The witness, the part of a transaction that holds signatures, has counted for less towards a block's size limit since SegWit, so it costs less. The picture sits inside a branch of script, opened with the instruction OP_IF, that never runs.

Because BIP-342 had dropped the limit on script size, one inscription could fill most of a block. BIP-342's authors had removed the limit because the time a computer spends checking a signature no longer grew with the size of the script. On 1 February 2023 one did: a single transaction of 3.9 megabytes took up almost all of block 774,628. It held a picture for Taproot Wizards, an Ordinals project whose co-founder Eric Wall later called it “the 4MB Taproot Wizard jpeg”.

Taproot's share of transactions soared. In the 30 days to 31 May 2023, 58% of all Bitcoin transactions spent coins from a Taproot address, by the same count, and about seven in ten of the Taproot coins spent carried an inscription. On 31 December 2023 the share reached 85% for the day. Inscriptions faded in 2026, from about 100,000 a day in February to fewer than 10,000 a day from May, and Taproot's share fell with them, to about 5% of transactions in September 2026.

Are inscriptions spam?

Some Bitcoin users wanted inscriptions gone. “Inscriptions are exploiting a vulnerability in Bitcoin Core to spam the blockchain,” Luke Dashjr, the Bitcoin Knots maintainer, wrote in December 2023, as The Block reported. Bitcoin Core had long let users limit how much extra data their nodes would pass on, and inscriptions, he argued, got round that limit by disguising their data as program code. Bitcoin Knots added a filter against them, and OCEAN, a mining pool Dashjr co-founded, began using it, saying “our blocks will now include many more real transactions”.

Others said the fee a transaction pays, not what it carries, should decide. “Classifying them as spam is subjective,” Jameson Lopp, then chief technology officer of the bitcoin custody company Casa, told The Block: “it depends on if you believe that you should get to decide what use cases are an appropriate use of the Bitcoin protocol or if you believe that any valid transaction that pays a competitive fee should be allowed to purchase block space.” In June 2025 a group of Bitcoin Core contributors argued that filters are easy to get round, because users and miners can deal with each other directly. “This is not endorsing or condoning non-financial data usage,” they wrote, “but accepting that as a censorship-resistant system, Bitcoin can and will be used for use cases not everyone agrees on.”

The fight then moved to Bitcoin's rules. BIP-110, which credits Dashjr with its original draft, proposed a soft fork that for one year would, among other limits, make invalid any Tapscript that uses OP_IF, the instruction inscriptions are wrapped in. It called OP_IF “commonly abused today to inject spam that gets skipped at execution”. Like the LOT=true client of 2021, it told nodes to reject blocks that didn't signal support. Block 961,632, mined on 8 August 2026, didn't, so nodes enforcing BIP-110 rejected it and split off from the rest of the network. The BIP was closed the next day, “following a chain split with stalled mining”. Dashjr's profile tells the rest of that story.

Is Taproot a quantum risk?

Taproot has one more open question: what happens if quantum computersQuantum computer (qubit)A computer that uses quantum physics to solve some problems far faster than ordinary ones. Its working parts are called qubits. become powerful enough to work out a private key from its public keyPublic keyThe partner of a private key. It lets anyone check a signature without revealing the private key under current computing assumptions.. Most older kinds of address show only a fingerprint of the key until the coins are spent, but a Taproot address contains a public key from the start. Its authors chose that on purpose. Hiding keys behind a fingerprint is often said to protect against quantum computers, but a footnote in BIP-341 argues that “this protection is very weak at best: transactions are not protected while being confirmed, and a very large portion of the currency's supply is not under such protection regardless”.

BIP-360, accepted into the BIPs collection as a draft in February 2026, takes the other view. It proposes a new kind of output that works like Taproot “but with the key path spend removed”, so no public key sits on the blockchain. “The key spend is not quantum-safe because it exposes the public key,” Ethan Heilman, a cryptography researcher and one of its authors, told Decrypt, “which means that a quantum attacker could attack the key spend and steal your funds, even if the script spend was totally safe.”

Tim Ruffing, one of BIP-340's authors, argued in July 2025 that Taproot's backup conditions are already safe. “Taproot, when restricted to script-path spends, is post-quantum secure,” he wrote on the mailing list, summing up a new paper. He said that supports a two-step upgrade: first add quantum-safe signatures to Bitcoin's scripts, then, before a large quantum computer exists, switch off spending with today's signatures. Coins whose backup conditions could still be met would stay spendable.

Nobody knows when such a machine might exist. “I would be really surprised if it happens within the next five years,” Heilman told Decrypt. Lopp told the same publication it would take “probably over a decade, maybe even several decades”. As of October 2026 BIP-360 is still a draft, and nothing about Taproot has changed on the network. The wider argument, over whether coins that are never moved to safety should be frozen, is set out in Should Bitcoin freeze coins to stop quantum theft?