Taproot was Bitcoin's largest soft fork since SegWit and, like CSV (BIPs 68/112/113) and SegWit (BIPs 141/143/147) before it, bundled several BIPs into a single activation. Schnorr signatures (BIP 340), Taproot output spending (BIP 341), and Tapscript (BIP 342) all activated together at block 709,632 on November 14, 2021. Together they reshape how multisig, smart contracts, and key aggregation work on Bitcoin.
The activation itself was almost boring, miner signaling cleared the 90% threshold six weeks after Speedy Trial started and the lock-in period finished at 98%. The technical surface area, on the other hand, is enormous. Years of research went into producing it.
Speedy Trial
Bitcoin's previous soft-fork activations (CSV, SegWit) used BIP9 versionbits with multi-month signaling windows that miners could deadlock by withholding signal. Taproot used a new mechanism, Speedy Trial (a modified BIP9 with a 90% threshold and a fixed minimum activation height), that gives miners a defined three-month window to signal and either locks in at the threshold or fails the trial.
Speedy Trial signaling started at block 681,408 on May 1, 2021 (the start time was April 24, but signaling periods begin on retarget boundaries). Lock-in happened at 687,456 in June 2021. Activation was fixed in advance at block 709,632 (the minimum activation height), which came five months after lock-in.
What changed
Three things shipped together:
- Schnorr signatures (BIP 340). A different signature scheme, provably secure, with smaller, fixed-size signatures (64 bytes vs ECDSA's variable-length DER, up to 72) and the property that signatures from multiple keys can be aggregated into a single signature.
-
Taproot output type (BIP 341). A new SegWit v1 output type:
witness_v1_taproot. Addresses start withbc1p.... Spending paths can either reveal a single key (the common case) or reveal an arbitrary script from a precommitted Merkle tree (the alternative case). - Tapscript (BIP 342). An updated script language for the rare alternative-path spends. New opcodes, same general shape as Bitcoin Script.
Why key aggregation matters
Pre-Taproot, a 2-of-3 multisig wallet put two signatures and three pubkeys on chain. Anyone watching could see "this is multisig" and how many parties were involved.
Post-Taproot with Schnorr key aggregation (MuSig2 for n-of-n, FROST for true thresholds like 2-of-3), the cooperative spend can produce a single aggregated key and a single signature. On chain, it's indistinguishable from a single-sig spend. The privacy gain for high-value custody arrangements is enormous.
There's a subtle script-path side: if the parties can't reach agreement off chain, the alternative-path Merkle tree can include the explicit "any 2 of these 3 keys" script. That fallback is only revealed if used; in the happy path, nobody outside the wallet knows the multisig structure exists.
Adoption since
Taproot adoption was initially slow, most wallets defaulted to bech32 SegWit
addresses (bc1q...) for years. Sparrow offered bc1p as an opt-in
script type from activation day, November 14, 2021, but kept Native SegWit
(bc1q) as its default. Inscriptions
(Bitcoin Ordinals) emerged in early 2023 as a use of the Tapscript script-path,
not the spending path Taproot's authors had in mind. Inscriptions
accelerated bc1p adoption, even if controversially.
Pull a block from September 2026 and check its height and transaction count:
Want to look at a specific Taproot-spending tx? Search a block at
verbose=2 and find outputs with type
witness_v1_taproot. Their addresses are bech32m-encoded
starting with bc1p.
The political backstory
Unlike SegWit, Taproot's activation was relatively quiet. The technical community had been working on the design since 2018: Gregory Maxwell proposed Taproot on the bitcoin-dev list in January 2018, and Pieter Wuille, Jonas Nick, and Anthony Towns published the BIP drafts in May 2019. Speedy Trial was a deliberate choice to end an activation-method debate that had already run for more than a year.
Miner signaling missed the 90% threshold in the first two signaling periods and crossed it in the third, on June 12, 2021, six weeks after signaling began. Activation was, by Bitcoin standards, drama-free. The drama came later, when Ordinals turned out to use Tapscript in ways the proponents of Taproot hadn't anticipated. That story gets its own page.
Sources
- Bitcoin Core 0.12.1 release notes, Bitcoin Core project, April 15, 2016. The CSV soft fork deployed BIPs 68, 112 and 113 as one BIP9 deployment.
- Bitcoin Core 0.13.1 release notes (segwit), Bitcoin Core project, October 27, 2016. The segwit deployment (BIPs 141, 143, 144, 145) and BIP 147 activated together on one BIP9 bit.
- BIP 341: Taproot: SegWit version 1 spending rules, Pieter Wuille, Jonas Nick, Anthony Towns, January 19, 2020. Key-path and script-path spending, plus the Speedy Trial parameters: bit 2, 90% threshold, minimum activation height 709,632.
- Bitcoin Core 0.21.1 release notes, Bitcoin Core project, May 1, 2021. Speedy Trial described as a variation of BIP9 versionbits, with Taproot active as of block 709,632.
- BIP 340: Schnorr Signatures for secp256k1, Pieter Wuille, Jonas Nick, Tim Ruffing, January 19, 2020. Provable security, the fixed 64-byte signature format, and key aggregation.
- BIP 11: M-of-N Standard Transactions, Gavin Andresen, October 18, 2011. A 2-of-3 OP_CHECKMULTISIG spend carries two signatures and three public keys.
- BIP 327: MuSig2 for BIP340-compatible Multi-Signatures, Jonas Nick, Tim Ruffing, Elliott Jin, March 22, 2022. MuSig2 is an n-of-n multi-signature scheme and does not cover t-of-n thresholds.
- Sparrow Wallet docs: Quick Start, Sparrow Wallet project, undated (accessed October 5, 2026). Sparrow's default script type is Native SegWit (P2WPKH).
- sparrowwallet/sparrow: SettingsController.java, Craig Raw (Sparrow Wallet), master as of October 5, 2026. New wallets are created with ScriptType.P2WPKH.
- Inscribing Mainnet, Casey Rodarmor, January 20, 2023. Inscriptions ready for mainnet.
- Ordinal Theory Handbook: Inscriptions, ordinals project, undated. Inscription content is stored in taproot script-path spend scripts.
- [bitcoin-dev] Taproot: Privacy preserving switchable scripting, Gregory Maxwell, January 22, 2018. The original Taproot proposal.
- [bitcoin-dev] Taproot proposal, Pieter Wuille, May 6, 2019. The bip-taproot and bip-tapscript drafts.
Read more: The Halvings.