Taproot, Schnorr and MAST : understanding the 2021 upgrade

Taproot×TaprootMajor Bitcoin upgrade activated in November 2021 (BIP 341). Brings more privacy, scripting flexibility and the efficiency of Schnorr signatures.See in the lexicon → is the most significant Bitcoin softfork since SegWit×SegWit (Segregated Witness)Upgrade activated in 2017 that separates signature data from the rest of the transaction. Lowered fees and paved the way for Lightning Network.See in the lexicon → in 2017. Activated on 14 November 2021 at block height 709 632, it combines three BIPs that complement each other : Schnorr×SchnorrMore modern signature algorithm, activated by Taproot in 2021 (BIP 340). More efficient, enables signature aggregation (MuSig2).See in the lexicon → (signatures), Taproot (output structure), Tapscript×TapscriptScript language introduced by Taproot (BIP 342), an extended version of Bitcoin script with new opcodes. Technical basis of recent uses, from native multisigs to inscriptions.See in the lexicon → (enhanced script language). The whole was crafted over more than two years by Pieter Wuille, Tim Ruffing, Anthony Towns, Greg Maxwell and several other contributors, without the controversy of the previous softfork.

Taproot's appeal rests on three operational propositions. First, Schnorr signatures replace ECDSA×ECDSALegacy signature algorithm used by Bitcoin before Taproot. Signs a transaction with a private key to prove ownership.See in the lexicon → in new scripts : smaller, aggregatable, provably secure under a standard cryptographic assumption. Second, Taproot outputs make a 3-of-5 multisig×Multisig (multi-signature)Configuration where a transaction must be signed by several independent keys to be valid (for example 2 of 3). Reduces the risk that a single key theft causes loss of funds.See in the lexicon → indistinguishable from a single-sig payment to external observation, improving privacy across the whole network. Third, MAST×MAST (Merkleized Alternative Script Trees)Structure introduced with Taproot: several spending conditions for the same UTXO, organised as a tree. Only the branch actually used is revealed on-chain, the rest stays private.See in the lexicon → lets contracts with multiple branches be encoded without revealing the unused branches to the chain.

Five years later, Taproot adoption exceeds 25 % of recent UTXO×UTXO (Unspent Transaction Output)« Chunk » of bitcoin received and not yet spent. A wallet does not have a single balance, it has a collection of UTXOs whose sum makes up the balance.See in the lexicon → outputs, MuSig2×MuSig2Schnorr signature aggregation protocol (BIP 327). Lets multiple signers produce a single signature indistinguishable from a single-signer one.See in the lexicon → is implemented in Sparrow, Specter, Casa and Unchained, and the first Lightning channel×Lightning channel2-of-2 multisig between two participants that lets them exchange sats off-chain as many times as they like, until they close the channel and publish the final balance on Bitcoin.See in the lexicon → factory applications use Taproot. This article dissects each of the three BIPs, MuSig2 aggregation, MAST, the adoption state, and concrete applications.

BIP 340 : Schnorr signatures

Bitcoin used the ECDSA×ECDSALegacy signature algorithm used by Bitcoin before Taproot. Signs a transaction with a private key to prove ownership.See in the lexicon → algorithm (Elliptic Curve Digital Signature Algorithm) on the secp256k1×secp256k1Mathematical elliptic curve used by Bitcoin to generate private / public key pairs. Different from SHA-3 / Keccak (Ethereum).See in the lexicon → curve since 2009. ECDSA works but has two historical limits : its signatures do not aggregate natively, and its security proof is less clean than that of other signature schemes. Claus-Peter Schnorr×SchnorrMore modern signature algorithm, activated by Taproot in 2021 (BIP 340). More efficient, enables signature aggregation (MuSig2).See in the lexicon → proposed in 1988 an alternative scheme (Schnorr signatures) whose patent expired in 2008, just in time for Bitcoin, but Satoshi×Satoshi (sat)The smallest unit of bitcoin. 1 BTC = 100 million satoshis. Named after the creator. In 2026, talking in sats becomes common as the price of one BTC rises.See in the lexicon → chose ECDSA for industrial standardisation reasons.

BIP×BIP (Bitcoin Improvement Proposal)Standard document that describes a proposed improvement to the Bitcoin protocol. Numbered (BIP 32, BIP 39, BIP 174, and so on). Open, public process on GitHub.See in the lexicon → 340 (Pieter Wuille, Jonas Nick, Tim Ruffing, 2020) introduces Schnorr signatures in Bitcoin via Taproot×TaprootMajor Bitcoin upgrade activated in November 2021 (BIP 341). Brings more privacy, scripting flexibility and the efficiency of Schnorr signatures.See in the lexicon →. Three mathematical properties distinguish Schnorr from ECDSA. First, linearity : the sum of two Schnorr signatures is still a valid Schnorr signature, which enables native aggregation (we come back to it with MuSig2×MuSig2Schnorr signature aggregation protocol (BIP 327). Lets multiple signers produce a single signature indistinguishable from a single-signer one.See in the lexicon →). Second, the security proof in the random oracle model is more direct, under the standard discrete logarithm assumption. Third, signatures are slightly smaller (64 bytes versus 71-72 for ECDSA), which reduces the weight of multisig×Multisig (multi-signature)Configuration where a transaction must be signed by several independent keys to be valid (for example 2 of 3). Reduces the risk that a single key theft causes loss of funds.See in the lexicon → transactions.

In practice, an average user does not see the difference when signing a single-sig Taproot transaction : their wallet×WalletSoftware or device that manages your Bitcoin keys and lets you sign transactions. A wallet does not really « hold » your bitcoins, it holds the keys that prove you own them.See in the lexicon → uses Schnorr under the hood, the transaction lands in the block, the recipient cashes in. But the cryptographic economy changes with aggregation. A traditional 3-of-5 multisig publishes 3 distinct signatures (3 × 71 bytes) plus the unlocking script. A 3-of-5 Schnorr+MuSig2 multisig publishes a single aggregated signature (64 bytes), indistinguishable from a single-sig.

BIP 341 : Taproot outputs and MAST

BIP×BIP (Bitcoin Improvement Proposal)Standard document that describes a proposed improvement to the Bitcoin protocol. Numbered (BIP 32, BIP 39, BIP 174, and so on). Open, public process on GitHub.See in the lexicon → 341 defines the format of Taproot×TaprootMajor Bitcoin upgrade activated in November 2021 (BIP 341). Brings more privacy, scripting flexibility and the efficiency of Schnorr signatures.See in the lexicon → outputs. A Taproot address starts with bc1p (instead of bc1q for SegWit×SegWit (Segregated Witness)Upgrade activated in 2017 that separates signature data from the rest of the transaction. Lowered fees and paved the way for Lightning Network.See in the lexicon → v0). It encodes a single public key×Public keyNumber derived mathematically from the private key, used to build a Bitcoin address. Can be shared freely.See in the lexicon → that can be unlocked in two ways : by a Schnorr×SchnorrMore modern signature algorithm, activated by Taproot in 2021 (BIP 340). More efficient, enables signature aggregation (MuSig2).See in the lexicon → signature (key-spend path, the most frequent case), or by executing a script chosen from a tree of possible scripts (script-spend path, for complex contracts).

The MAST×MAST (Merkleized Alternative Script Trees)Structure introduced with Taproot: several spending conditions for the same UTXO, organised as a tree. Only the branch actually used is revealed on-chain, the rest stays private.See in the lexicon → mechanism (Merklized Abstract Syntax Tree) underlies the script-spend path. The wallet×WalletSoftware or device that manages your Bitcoin keys and lets you sign transactions. A wallet does not really « hold » your bitcoins, it holds the keys that prove you own them.See in the lexicon → author defines a tree of possible scripts (for example : "Alice's single-sig", "2-of-3 multisig×Multisig (multi-signature)Configuration where a transaction must be signed by several independent keys to be valid (for example 2 of 3). Reduces the risk that a single key theft causes loss of funds.See in the lexicon →", "emergency script after 6 months"). Each leaf is a script. The Taproot public key is derived from a Merkle root summarising the tree, without revealing the individual scripts. At spend time, you pick the leaf you want to execute, prove its inclusion in the tree via parent hashes, and run it. Other leaves stay secret forever.

Consequence for privacy : as long as the key-spend path is used (the typical case), no external observer can guess whether or not a MAST tree exists behind. A single-sig, a 2-of-3 multisig with key aggregation, a complex time-locked vault×VaultCustody setup for long-term storage, often multisig, kept offline and touched rarely.See in the lexicon → all look like the same bc1p address to observation. This is Taproot's big privacy step, more important in the long run than the size gains.

BIP 342 : Tapscript

Tapscript×TapscriptScript language introduced by Taproot (BIP 342), an extended version of Bitcoin script with new opcodes. Technical basis of recent uses, from native multisigs to inscriptions.See in the lexicon → is the updated version of the Bitcoin Script language usable in the script-spend path of a Taproot×TaprootMajor Bitcoin upgrade activated in November 2021 (BIP 341). Brings more privacy, scripting flexibility and the efficiency of Schnorr signatures.See in the lexicon → output. It keeps most of the old Script (the usual opcodes OP_DUP, OP_HASH160, OP_CHECKSIG, etc.) but introduces three important changes. First, OP_CHECKSIG and OP_CHECKSIGVERIFY now use Schnorr×SchnorrMore modern signature algorithm, activated by Taproot in 2021 (BIP 340). More efficient, enables signature aggregation (MuSig2).See in the lexicon → signatures instead of ECDSA×ECDSALegacy signature algorithm used by Bitcoin before Taproot. Signs a transaction with a private key to prove ownership.See in the lexicon →. Second, OP_CHECKMULTISIG is removed (it was a source of overhead and ambiguity) and replaced by OP_CHECKSIGADD, a more flexible opcode×OpcodeElementary instruction of the Bitcoin script language (OP_CHECKSIG, OP_RETURN...). Scripts combine opcodes to define the spending conditions of funds.See in the lexicon → that is easier to analyse.

Third, Tapscript prepares the ground for future extensibility via Tapleaf versions. Each leaf of the MAST×MAST (Merkleized Alternative Script Trees)Structure introduced with Taproot: several spending conditions for the same UTXO, organised as a tree. Only the branch actually used is revealed on-chain, the rest stays private.See in the lexicon → tree carries a version number telling how it should be interpreted. Version 0 is current Tapscript ; versions 1-255 are reserved for future evolutions (potentially including OP_CTV, OP_VAULT×VaultCustody setup for long-term storage, often multisig, kept offline and touched rarely.See in the lexicon → and the covenants under discussion). This extensibility reduces the cost of future soft-forks since they can add new opcodes without breaking existing things.

For a wallet×WalletSoftware or device that manages your Bitcoin keys and lets you sign transactions. A wallet does not really « hold » your bitcoins, it holds the keys that prove you own them.See in the lexicon → developer, Tapscript is nicer to use than the old Script. For an end user, it is transparent. Backward compatibility is guaranteed : P2PKH, P2SH, P2WPKH and P2WSH outputs (the old formats) keep working indefinitely ; Taproot is purely additive.

MuSig2 : aggregating keys and signatures

MuSig2×MuSig2Schnorr signature aggregation protocol (BIP 327). Lets multiple signers produce a single signature indistinguishable from a single-signer one.See in the lexicon → (Nick, Ruffing, Seurin, 2020) is the Schnorr×SchnorrMore modern signature algorithm, activated by Taproot in 2021 (BIP 340). More efficient, enables signature aggregation (MuSig2).See in the lexicon → signature aggregation protocol used in practice in 2026. It lets N signers combine their public keys into a single aggregated public key×Public keyNumber derived mathematically from the private key, used to build a Bitcoin address. Can be shared freely.See in the lexicon → (which becomes the Taproot×TaprootMajor Bitcoin upgrade activated in November 2021 (BIP 341). Brings more privacy, scripting flexibility and the efficiency of Schnorr signatures.See in the lexicon → address), then jointly produce a single Schnorr signature valid under that aggregated key. The result looks exactly like a single-sig to the blockchain×BlockchainA public, shared ledger that records every Bitcoin transaction in blocks linked together cryptographically. Each participant in the network keeps a copy.See in the lexicon →, while it took N participations to produce it.

The practical benefit is massive for modern multisigs. A 2-of-2 between spouses, a 3-of-5 company, a hardware-wallet×WalletSoftware or device that manages your Bitcoin keys and lets you sign transactions. A wallet does not really « hold » your bitcoins, it holds the keys that prove you own them.See in the lexicon →-backed 2-of-3 use MuSig2 to produce a single signature. The transaction is smaller (lower fees), faster to validate, and confidential against external observers who can no longer distinguish a multisig×Multisig (multi-signature)Configuration where a transaction must be signed by several independent keys to be valid (for example 2 of 3). Reduces the risk that a single key theft causes loss of funds.See in the lexicon → from a personal wallet. Casa and Unchained switched their new multisigs to MuSig2 from 2024 ; Sparrow and Specter have it in 2025.

The protocol needs two communication rounds between signers (an exchange×ExchangeService that lets you buy, sell and swap cryptocurrencies against fiat money. Examples : Kraken, Coinbase, Bitstamp, Bitvavo. Most are custodial.See in the lexicon → of committed nonces, then an exchange of partial signatures), which is compatible with a collective signature performed via PSBT×PSBT (Partially Signed Bitcoin Transaction)Standard format (BIP 174) that lets you build a transaction on one device, sign it on another and broadcast it from a third. Backbone of the modern multisig workflow.See in the lexicon → (Partially Signed Bitcoin Transaction) on separate hardware wallets. The underlying cryptography is trickier than ECDSA×ECDSALegacy signature algorithm used by Bitcoin before Taproot. Signs a transaction with a private key to prove ownership.See in the lexicon → (nonces must be generated correctly or risk key leakage), which means implementations must be careful. The libsecp256k1×libsecp256k1Reference cryptographic library for Bitcoin, written in C and maintained by the Bitcoin Core developers. Used by almost every serious wallet.See in the lexicon → library and BIP327 standardise the protocol.

Adoption state in 2026

Five years after activation, Taproot×TaprootMajor Bitcoin upgrade activated in November 2021 (BIP 341). Brings more privacy, scripting flexibility and the efficiency of Schnorr signatures.See in the lexicon → adoption has progressed by steps. Early 2022, fewer than 1 % of issued outputs used the bc1p format, mainly test transactions and a few early adopters. End 2022, ~3 %. End 2023, ~10 %, driven by the Ordinals×Ordinals (inscriptions)Protocol (2023) that numbers each satoshi and allows inscribing data (images, text) directly on-chain via Tapscript. At the origin of the debate on block space usage.See in the lexicon →/Inscriptions frenzy which uses Taproot massively. End 2024, ~18 %. In 2026, we regularly pass 25 % of Taproot outputs in recent blocks.

Wallet×WalletSoftware or device that manages your Bitcoin keys and lets you sign transactions. A wallet does not really « hold » your bitcoins, it holds the keys that prove you own them.See in the lexicon →-side adoption is now widespread. Bitcoin Core×Bitcoin CoreReference implementation of the Bitcoin software, written in C++ and maintained by an open-source community. This is the software that most nodes run.See in the lexicon → generates Taproot addresses by default since version 24 (2022). Sparrow, Specter, Electrum, BlueWallet, Phoenix, Muun, Wallet of Satoshi×Satoshi (sat)The smallest unit of bitcoin. 1 BTC = 100 million satoshis. Named after the creator. In 2026, talking in sats becomes common as the price of one BTC rises.See in the lexicon →, Aqua, Nunchuk : all support sending and receiving. On the custodial×CustodialModel in which a third party (exchange, broker, neobank) holds your private keys for you. You have a claim, not a bitcoin. « Not your keys, not your coins ».See in the lexicon → multisig×Multisig (multi-signature)Configuration where a transaction must be signed by several independent keys to be valid (for example 2 of 3). Reduces the risk that a single key theft causes loss of funds.See in the lexicon → side, Casa, Unchained and Liana have shifted their new setups to Taproot+MuSig2×MuSig2Schnorr signature aggregation protocol (BIP 327). Lets multiple signers produce a single signature indistinguishable from a single-signer one.See in the lexicon → between 2024 and 2026. Older multisig setups on P2WSH (bc1q) formats remain functional but do not benefit from the privacy gains.

Residual brakes mainly come from exchanges and institutional providers. Many accept withdrawals to Taproot (sending to a bc1p address), but few use Taproot for their internal moves, fearing incompatibilities with their compliance and accounting tools. This inertia is dissolving : Coinbase announced in 2025 a progressive switch, Kraken in 2026. When institutional exchanges switch, Taproot will become the majority format.

Applications : modern multisig and Lightning

Confidential multisig×Multisig (multi-signature)Configuration where a transaction must be signed by several independent keys to be valid (for example 2 of 3). Reduces the risk that a single key theft causes loss of funds.See in the lexicon →. Before Taproot×TaprootMajor Bitcoin upgrade activated in November 2021 (BIP 341). Brings more privacy, scripting flexibility and the efficiency of Schnorr signatures.See in the lexicon →, a 2-of-3 multisig published in the chain its unlock script at spend time, which revealed to the observer that it was a multisig and even how many cosigners existed. With Taproot+MuSig2×MuSig2Schnorr signature aggregation protocol (BIP 327). Lets multiple signers produce a single signature indistinguishable from a single-signer one.See in the lexicon →, the multisig is indistinguishable from a single-sig. It is the most tangible anonymity gain for advanced users : a pro wallet×WalletSoftware or device that manages your Bitcoin keys and lets you sign transactions. A wallet does not really « hold » your bitcoins, it holds the keys that prove you own them.See in the lexicon → with 3 hardware wallets in multisig looks like any personal wallet to the blockchain×BlockchainA public, shared ledger that records every Bitcoin transaction in blocks linked together cryptographically. Each participant in the network keeps a copy.See in the lexicon →.

Vaults and time-locked safes. Liana (Wizardsardine, 2023) uses MAST×MAST (Merkleized Alternative Script Trees)Structure introduced with Taproot: several spending conditions for the same UTXO, organised as a tree. Only the branch actually used is revealed on-chain, the rest stays private.See in the lexicon → to build vaults with multiple spend paths : "Alice's main key" (key-spend, instant), or "Alice plus lawyer after 6 months of inactivity" (script-spend MAST, recovery branch), or "heir after 3 years" (another branch). As long as Alice uses the main path, the recovery branches stay secret to the blockchain. It is the major step forward for Bitcoin inheritance.

Lightning channel×Lightning channel2-of-2 multisig between two participants that lets them exchange sats off-chain as many times as they like, until they close the channel and publish the final balance on Bitcoin.See in the lexicon → factories. As mentioned in the advanced Lightning article, channel factories need Taproot to work efficiently. A Taproot factory looks like a single-sig to the chain while it internally hosts several Lightning channels between several participants. The on-chain cost is mutualised, privacy is preserved. First experimental rollouts in 2025, general availability hoped for 2027-2028. This is Lightning's next big step, and it relies entirely on Taproot.