Taproot let cooperating signers look like a single key

Inherited archive entry · retained from the earlier edition. Its factual, legal and policy claims have not all been reverified for 19 September 2026. Research scope.

A soft fork that activated in November 2021

Taproot activated on the Bitcoin network at block 709,632, mined 14 November 2021, according to the block record. The specification behind it, BIP341, authored by Pieter Wuille, Jonas Nick and Anthony Towns and created 19 January 2020, defines a new type of spendable output built on Segregated Witness's versioning scheme. Bitcoin Core 22.0, released 13 September 2021, shipped the wallet and descriptor support needed to use the new outputs once the network-wide activation the block record shows had occurred.

What Schnorr signatures and script trees change

The upgrade combines two related documents. BIP340, from the same three authors and dated the same day as BIP341, specifies Schnorr signatures for Bitcoin's curve, chosen because they are linear: several collaborating signers can combine their individual keys into a single aggregate key and produce one aggregate signature, rather than each publishing a separate signature as older multi-signature schemes required. BIP341 pairs this with a Merkle tree of alternative spending scripts, of which only the branch actually used needs to be revealed when funds move; every other possible condition stays unpublished. Together, these mean a multi-party arrangement that cooperates normally can settle on-chain looking identical to an ordinary single-key payment, while retaining a fallback script path for cases where cooperation fails.

The boundary: what looks the same is not the same guarantee

This is a meaningful change for custody arrangements that use multiple keys, because it lets a well-run multi-signature or threshold setup avoid publishing its internal structure on-chain when everything goes as planned. It is a narrower claim than 'Taproot makes Bitcoin private.' A spend that must fall back to revealing a script branch, because a cosigner is unavailable, discloses exactly the structure a key-path spend would have hidden; the two spending paths are visibly different on the same chain, which is a structural property of the output type rather than a guarantee about who can observe it. Improved indistinguishability under cooperation is not the same as unlinkability under every condition, and the specification itself makes no privacy claim beyond the mechanism described; that boundary is an editorial reading of what the documents support, not a statement either BIP makes.

Questions to carry forward

• Does a wallet advertised as 'Taproot-private' rely on cooperative key-path spending working every time, and what does it do when a script-path fallback is required?
• What proportion of on-chain value has moved to taproot-type outputs since November 2021, and does that figure come from a chain-analysis source or a wallet vendor?
• For a multisignature custody setup, does adopting Taproot change who must be trusted, or only what a routine transaction looks like on-chain?

The activation date and the two specifications are firm; the privacy improvement they enable is real but conditional, and the condition, that every party cooperates and no script path is ever needed, is exactly the scenario in which the improvement is easiest to overstate.