Bitcoin Taproot Explained: What Changed & What Comes Next

Introduction

Bitcoin's most recent rule change is almost five years old, and a full count of eight blocks from 20 October 2026 finds Taproot behind 8.0% of the inputs spent. Active since block 709,632 on 14 November 2021, Taproot lets a contract with many signers spend as one 64-byte signature and hides every unused spending path. It also made Ordinals inscriptions possible and set the base for later proposals, from covenant opcodes to a quantum-ready output type. This guide explains in plain terms what Taproot changed, measures its use input by input and settles a disagreement between two earlier samples of the same blocks. It also separates the rule-change fights since October 2025 and compares covenant proposals by their documented status, without predicting which one activates.

What Did the Taproot Upgrade Change in Bitcoin?

Taproot, active since block 709,632 on 14 November 2021, bundled three proposals. They changed how Bitcoin outputs are locked and spent: Schnorr signatures (BIP340), a new output type with its own spending rules (BIP341) and a revised scripting language (BIP342). Together they let a complex contract spend as a single 64-byte signature.

Schnorr signatures (BIP340)

BIP340 adds Schnorr signatures on the same secp256k1 curve that ECDSA used. A Schnorr signature is a fixed 64 bytes, against 71 to 72 bytes for a DER-encoded ECDSA signature (Spark, 2026). The scheme is linear, so several signers can combine their public keys and signatures into one key and one signature, a technique called key aggregation. MuSig2 (BIP327) specifies one such protocol and the BIP register lists it as deployed (bitcoin.org, 2026). On chain, a 3-of-3 signing group then looks identical to a single wallet. Schnorr also permits batch verification, which checks many signatures faster than checking them one by one (Spark, 2026).

Taproot outputs and the key path (BIP341)

BIP341 defines Pay-to-Taproot (P2TR), the first output type to use SegWit version 1. The locking script holds one 32-byte public key and appears as a bc1p address. That key is an internal key adjusted by the Merkle root of an optional tree of scripts (BIP341, 2026). A spender then picks one of two routes. The key path needs one witness element, a 64-byte signature, and reveals no script. The script path reveals a single script plus a proof that it belongs to the tree. Parties who agree can always take the key path, so a contract that settles cooperatively leaves no trace of its terms.

Script trees and Tapscript (BIP342)

Each leaf of a Taproot script tree is a separate spending condition, a design close to a Merklized Abstract Syntax Tree (MAST). Only the executed leaf is revealed, with a control block of 33 bytes plus 32 bytes per tree level, down to a maximum depth of 128 (BIP341, 2026). BIP342 rewrites the script rules for those leaves. OP_CHECKMULTISIG is disabled in favour of OP_CHECKSIGADD, which counts valid signatures one by one. The 10,000-byte script limit and the 201 non-push opcode limit no longer apply. Unassigned OP_SUCCESS opcodes are reserved so later soft forks can add new opcodes (BIP342, 2026).

Data current as of November 2026.

Shipping all three proposals together as a soft fork meant miners, not users, had to signal readiness.

How Did Taproot Activate, and Why Is It Still the Last Upgrade?

Taproot activated through miner signalling at a 90% threshold, locked in during June 2021 and took effect at block 709,632 on 14 November 2021. It remains the most recent change to Bitcoin's consensus rules, and as of 4 November 2026 no later proposal has reached activation.

Speedy Trial and the 90% threshold

Taproot used Speedy Trial, a variant of the BIP9 signalling process. Miners had from 24 April 2021 until a timeout on 11 August 2021 to signal readiness, and 1,815 of the 2,016 blocks in a period, 90%, had to carry the signal (BIP341, 2026). The short window ended a failed attempt quickly. The deployment locked in during June 2021, and the minimum activation height of 709,632 set the date the new rules began, five months later (Spark, 2026). Node operators had that gap to upgrade, and miners had already shown the support that the threshold required.

Almost five years without a new consensus change

SegWit began on 24 August 2017 and Taproot on 14 November 2021, a gap of four years and almost three months. By November 2026 the gap since Taproot is almost five years. Proposals exist, but the BIP register lists the covenant opcodes as Draft or Complete, not Deployed, and lists BIP-110, the one proposal that forced a confrontation through signalling, as Closed (bitcoin.org, 2026). Bitcoin Core 30 changed relay policy in October 2025, which is a different layer from consensus. The beginner's guide to Bitcoin ↗ covers how nodes, miners and developers share that rule-making power. Activation made Taproot available. Adoption depended on wallets and protocols, and it can be counted.

How Much of Bitcoin Does Taproot Carry Today?

A full count of every input in eight blocks mined on 20 October 2026 found that 8.0% spent Taproot outputs, 4,605 of 57,826 inputs. Two earlier samples of the same blocks reported 9.6% and 6.3%, and the full count shows that both were off by about 1.6 and 1.7 percentage points.

What the census counted

The census read all 32,305 transactions in blocks 972,338 to 972,345 and classified every non-coinbase input. An input counts as Taproot when its witness has the Taproot shape. That means a single 64-byte or 65-byte signature (key path), or a control block of 33 bytes plus 32 per tree level at the end (script path). The classifier matched the block explorer's Taproot labels exactly on 12,035 inputs. Taproot inputs numbered 4,605, of which 3,908 used the key path and 697 the script path, and 555 of those script-path inputs carried an Ordinals envelope. A total of 2,213 of 32,297 non-coinbase transactions, 6.9%, spent at least one Taproot input (Blockstream and mempool.space, 2026).

Why two earlier samples disagreed

Both earlier samples read about ten pages of 25 transactions per block. One counted 358 Taproot inputs among 3,712 (9.6%) and the other 226 among 3,581 (6.3%). Taproot spending is lumpy. Three transactions with 251 to 280 Taproot inputs each hold 800 of the 4,605, and the share runs from 0.9% in block 972,338 to 21.1% in block 972,345. A page sample that catches one of those transactions overstates the share, and one that misses all three understates it. Without the three, the share is 6.7%. Neither earlier figure is right, and the full count is 8.0%. Glassnode, which divides spent Taproot inputs by all spent inputs, reported 8.482% on 17 October 2026 (Glassnode, 2026).

Data current as of November 2026.

How the share has moved since 2021

One full block per half year shows the shape. Taproot funded 0.0% of inputs in the activation block, 0.1% in May 2022 and 2.2% in November 2022. The share reached 13.4% in May 2023 as inscriptions began and 63.6% in November 2023, when 3,217 of the block's 3,643 Taproot inputs were script-path spends and 3,204 carried an Ordinals envelope. It fell to 32.3% in April 2024, 21.2% in October 2025 and 14.0% in April 2026, and the eight-block count of October 2026 reads 8.0%. A single block is a noisy reading, since the October 2026 blocks alone ranged from 0.9% to 21.1%, so the line shows direction, not exact levels (Blockstream and mempool.space, 2026).

What Has Taproot Made Possible?

Inscriptions, Lightning channels, asset issuance, bridges and off-chain payment trees all build on Taproot outputs, and only some of them involve payments at all. The uses split into data storage, asset protocols and scaling designs that borrow Bitcoin's security without changing its rules.

Inscriptions and the data debate

Ordinals inscriptions place files and text in the witness of a Taproot script-path spend (Ordinal Theory Handbook, 2026). Since SegWit, each witness byte counts one weight unit against four for other transaction data, so inscription data is charged a quarter of the weight (BIP141, 2015). BIP342 removed the 10,000-byte script limit, so a leaf is bounded by block weight alone. The ordinals.com index counted an average of 92,388 inscriptions a day in 2025 and 8,115 a day from 4 May to 19 October 2026 (Ordinal Theory Handbook and ordinals.com, 2026). BRC-20 tokens reuse the inscription pattern, while Runes record their data in OP_RETURN outputs. Mechanics for each belong to the companion guides on Ordinals ↗ and on BRC-20 and Runes ↗.

Taproot Assets, Lightning channels and MuSig2

Taproot Assets, built by Lightning Labs, issues assets such as stablecoins on bitcoin and moves them over Lightning. The software reached mainnet alpha on 18 October 2023. Tether announced on 30 January 2025 that USDT would use the protocol, and version 0.8 with a developer SDK followed on 23 June 2026 (Lightning Labs, 2026). Lightning's own channels ↗ gained Taproot outputs too: lnd v0.17 added opt-in MuSig2 Taproot channels in 2023 (lnd release notes, 2023). MuSig2 lets the channel partners close cooperatively with one signature, the key-path case, while a script path handles forced closes (Spark, 2026).

BitVM bridges and Ark

BitVM2 lets Bitcoin settle a dispute over an off-chain computation in three on-chain transactions, with no consensus change (BitVM2 paper, 2024). Citrea's Clementine bridge went live with its mainnet on 27 January 2026, and Spark describes it as the first production BitVM2 bridge. A 10 BTC deposit goes to a Taproot address with a bridge path and a refund path, and withdrawals carry a dispute window of about 1.5 days (Citrea, 2026; Spark, 2026). Ark lets users hold virtual coins in shared off-chain trees with a unilateral exit to Bitcoin. Arkade opened on mainnet in public beta on 21 October 2025 and Second's Bark followed on 9 June 2026 (Ark Labs, 2025; Bitfinex, 2026). The authors of BIP-360 name Lightning, BitVM and Ark among technologies that depend on Taproot addresses (bip360.org, 2026).

Which Fights Over Bitcoin's Rules Followed Taproot?

Three disputes since October 2025 each touched a different layer. Bitcoin Core 30 changed relay policy, BIP-110 tried to tighten consensus and failed, and the eCash (ECX) fork of 29 October 2026 started a separate chain. None changed the consensus rules that Taproot last altered.

Core 30 and the OP_RETURN policy change

Bitcoin Core 30.0, released on 10 October 2025, raised the default -datacarriersize limit to 100,000 bytes, so larger OP_RETURN data outputs relay by default (Bitcoin Core, 2025). The change is policy. Nodes and miners set their own limits, and consensus never capped OP_RETURN size. Miners differ in practice. In 144 blocks on 14 and 15 October 2026, 877 of 694,840 transactions, or 0.13% by count, carried an OP_RETURN output above 83 bytes, and TXID put their share of block space at about 0.5%. Foundry, F2Pool and ViaBTC included them, while AntPool did not (TXID, 2026). The latest release, Bitcoin Core 32.1, was published on 27 October 2026 (Bitcoin Core, 2026).

BIP-110 and the signalling that never came

BIP-110, the Reduced Data Temporary Softfork, would have made blocks invalid for one year if they carried data above set limits, including witness items over 256 bytes or a Taproot annex (bitcoin/bips, 2026). Activation needed 55% signalling. In the last voluntary period, 51 of 2,016 blocks (2.53%) signalled, all from OCEAN. In the mandatory window of 8 to 23 August 2026, 0 of 2,016 blocks signalled. Nodes enforcing the rule split off at block 961,632 on 8 August 2026 onto a branch that mined eight blocks and stalled. The BIPs repository marked BIP-110 Closed in August 2026. Bitcoin Knots 29.4.1, released 2 September 2026, moved that minority chain to a BLAKE2b proof of work from block 961,640 (TXID, 2026; Perth BitDevs, 2026). The main chain was unaffected.

The eCash (ECX) fork at block 973,728

eCash (ECX) is a hard fork of Bitcoin by LayerTwo Labs built around drivechains (BIP300 and BIP301). It is unrelated to the eCash (XEC) coin. An alpha fork ran at block 963,648 on 23 August 2026 and a beta at block 967,680 on 19 September. The permanent mainnet fork split from Bitcoin at block 973,728 on 29 October 2026 at about 19:14 UTC, crediting 1 ECX for each BTC held in self-custody at block 973,727 (CF Benchmarks, 2026). On the ECX chain about 500,000 Satoshi-era coins were reassigned, and five sidechains activated about four hours after the fork, following an initial miner veto (eCash, 2026). Bitcoin itself is unchanged. Replay protection is opt-in, so a transaction that spends unsplit pre-fork coins can also confirm on the eCash chain and send the ECX to the recipient (ecash.com, 2026). Exchanges decide for themselves whether to credit ECX. Claim portals that ask for a seed phrase are scams.

Data current as of November 2026.

The proposals developers argue about now are opcodes, not data limits.

Which Covenant Proposals Could Be Bitcoin's Next Soft Fork?

A covenant restricts how a coin can be spent later, for example only into a pre-agreed set of outputs. Three BIPs dominate the debate: CTV (BIP119), CSFS (BIP348) and OP_CAT (BIP347). Each would be a soft fork, and none is active.

CTV and CSFS

OP_CHECKTEMPLATEVERIFY (CTV, BIP119) checks that a spending transaction matches a hash committed in the output. Supporters cite vaults, congestion control and non-interactive channel openings, and critics say its fixed shape would invite further opcodes (Spark, 2026). OP_CHECKSIGFROMSTACK (CSFS, BIP348) verifies a signature against any message on the stack. With CTV it enables Lightning Symmetry channels (bitcoin/bips, 2026). A June 2025 open letter asked Bitcoin Core contributors to review both opcodes within six months (ctv-csfs.com, 2025). Bundles compete: LNHANCE adds OP_INTERNALKEY (BIP349) and OP_PAIRCOMMIT (BIP442) to CTV and CSFS (lnhance.org, 2026), while BIP446 and BIP448 package OP_TEMPLATEHASH with CSFS instead of CTV (Spark, 2026).

OP_CAT

OP_CAT (BIP347) joins two stack elements into one. Satoshi's original release contained it, and it was disabled in 2010 over denial-of-service concerns. The BIP re-enables it inside Tapscript by redefining OP_SUCCESS126, with the 520-byte element limit as the safeguard (Spark, 2026). Combined with hashing, it lets scripts inspect transaction fields and verify proofs. The BIP reached status Complete on 1 March 2026 at version 1.0.0 (bitcoin/bips, 2026). Complete describes the specification text and records no agreement to activate. No activation parameters or client exist for OP_CAT, and Bitcoin Inquisition's test network, signet, shows 1,015,910 transactions using OP_CAT against 451 using CTV (inquisition.observer, 22 October 2026).

What the activation record shows

CTV is the only covenant with an activation client. Its published parameters use version bit 5 and a 90% threshold of 1,815 of 2,016 blocks. The signalling window runs from 30 March 2026 to 30 March 2027, and the minimum activation height is 1,001,952, about May 2027 (CTV Activation, 2026). The window lasts a year, against about three and a half months for Taproot's Speedy Trial. In the retarget period that began at block 973,728, none of the first 784 blocks, up to block 974,511 on 4 November 2026, set version bit 5 for CTV, and none set any other version bit from 0 to 12 (own count of block version fields via mempool.space, 2026). The LNHANCE client, which runs to 3 January 2028, showed 0 of 1,714 required blocks in the epoch 475 report of 22 July 2026 (Stacker News, 2026). No forecast about which proposal activates is made here.

Data current as of November 2026.

Every proposal above builds on Tapscript, so the next question is whether Taproot's own key design holds up against quantum computers.

How Does Quantum Risk Change the Taproot Story?

Taproot stores a tweaked public key directly in the output, so the key is visible on chain before any coin moves. Google Quantum AI's March 2026 whitepaper calls that a security regression against hashed-key outputs, and BIP-360 proposes an output type without the key path.

Why a key-path output exposes a public key

Older output types such as P2PKH and P2WPKH commit to a hash of the public key, which stays hidden until the owner spends. P2TR commits to the key itself, as the original pay-to-public-key outputs did (Google Quantum AI, 2026). A quantum computer running Shor's algorithm can derive a private key from a visible public key. Google's paper estimates that breaking the elliptic-curve cryptography behind Bitcoin needs fewer than 500,000 physical qubits, far below the millions cited earlier. It says no such machine exists and the attack is not imminent (Google Quantum AI, 2026; CoinDesk, 2026). Google released the findings under coordinated disclosure, which a separate article on quantum vulnerability and responsible disclosure ↗ explains.

BIP-360 and what it would change

BIP-360 proposes Pay-to-Merkle-Root (P2MR), an output that commits to a script tree's Merkle root with no internal key, which removes the key path (bitcoin/bips, 2026). Existing script trees would move over with little change, while wallets that only use key-path spends would have to adopt a script tree. The authors state the limit: P2MR protects keys against long-exposure attacks, where a public key sits visible for longer than a confirmation takes. Short-exposure attacks, which recover a key from a transaction waiting in the mempool, would need post-quantum signatures. BIP-360 holds status Draft, and its version 0.12.1 is dated 24 July 2026. A separate draft, BIP-361, would restrict legacy ECDSA and Schnorr spends in two phases once a post-quantum output type exists (bips.dev, 2026).

How Should a Holder Think About Taproot Today?

A holder gains from Taproot mainly through lower fees on larger transactions ↗ and, where keys are aggregated, better privacy. A key-path input weighs 57.5 virtual bytes (vB), the smallest of the standard input types, while Taproot outputs are slightly larger than SegWit v0 outputs.

What a key-path spend saves

Input sizes run from 148 vB for P2PKH and 91 vB for P2SH-wrapped SegWit to 68 vB for P2WPKH and 57.5 vB for a P2TR key path (Blockstream, 2026). At an example rate of 10 sat/vB, a key-path input costs 575 sats against 680 sats for P2WPKH, a saving of 15.4%. Outputs go the other way, at 43 vB for P2TR against 31 vB for P2WPKH. A payment with one input and two outputs weighs 154 vB in P2TR against 140.5 vB in P2WPKH, so Taproot costs 9.6% more. Merging 10 inputs into one output weighs 628.5 vB against 721.5 vB, a saving of 12.9%. Many inputs favour Taproot, and few inputs favour SegWit v0.

What to check before using bc1p

Receiving at a bc1p address needs a sender whose wallet or exchange supports Bech32m, the address format for version 1 and later (BIP350, 2026). Withdrawal support varies by service, so a small test transfer settles the question before a large one. Spending needs wallet software that implements BIP341 signing, and most wallets still default to native SegWit ↗ and offer Taproot as an opt-in account type (Spark, 2026). Taproot offers no hash cover for the public key, the trade-off set out above. Inscription-aware wallets keep inscribed coins apart from ordinary ones, and a plain wallet has no such guard (Ordinal Theory Handbook, 2026).

FAQ

?Can every wallet and exchange send bitcoin to a bc1p address?

No. The sender's wallet must support Bech32m, the address format for SegWit version 1 and later (BIP350). A wallet that does not implement Bech32m cannot parse the address. Exchanges also decide separately whether to allow withdrawals to bc1p addresses, and policies differ. The practical check is a small test transfer before the full amount, and a look at the service's withdrawal documentation.

?Was Taproot a soft fork or a hard fork, and does the difference matter?

Taproot was a soft fork. A soft fork tightens or adds rules so that blocks following the new rules are still valid to older nodes, which means nodes that did not upgrade stayed on the same chain. A hard fork loosens the rules and splits off every node that does not upgrade. Taproot needed 90% of miners to signal, and nodes that enforced it protected the new rules from 14 November 2021.

?Does Taproot make Bitcoin transactions fully private?

No. A key-path spend reveals nothing but one signature, which hides the script behind it, but amounts, addresses and the transaction graph stay visible. A script-path spend reveals the script it used, and inscription reveals are easy to recognise from their witness shape. Chain analysis therefore still works on Taproot coins. Privacy improves most when many users and contracts share the key path, which makes wallet defaults matter.

?Is Taproot used on the Lightning Network?

Yes. The lnd node software added opt-in Taproot channels built on MuSig2 in version 0.17 in 2023, and Taproot Assets sends stablecoin-style assets over Lightning channels. A simple Taproot channel closes cooperatively through the key path and falls back to a script path for a forced close. Adoption varies by node software, so a given channel may still use older output types.

?Could a covenant soft fork such as CTV affect coins that are already held?

Not by default. CTV and similar opcodes only constrain an output whose locking script uses them, so existing outputs keep their current rules. Someone would have to choose to send coins into a covenant-based script. The debate concerns which new scripts become possible, whether wallets adopt them and what misuse risks the opcodes carry, such as recursion. It does not concern a change to coins in ordinary outputs.

?How can anyone check whether a transaction input used Taproot?

A block explorer that reports the type of the output being spent will show it. Esplora-based services such as Blockstream and mempool.space expose a field named scriptpubkey_type, which reads v1_p2tr for a Taproot output. Raw data gives the same answer. A witness with a single 64-byte or 65-byte item is a key-path spend, and a witness whose last item is a control block of 33 plus 32 times m bytes is a script-path spend.

?Does the failure of BIP-110 mean Bitcoin's rules cannot change?

No. It shows that a rule change needs real support from the miners and nodes that enforce it. BIP-110 reached 0 of 2,016 signalling blocks in its mandatory window, and the nodes that enforced it split onto a chain that stalled. Taproot reached its 90% threshold in 2021. Which future proposal, if any, gathers comparable support is not something this article predicts.

?Does the eCash (ECX) fork put the bitcoin in a wallet at risk?

Not directly. The fork, at block 973,728 on 29 October 2026, left bitcoin balances and the main chain untouched. The risk is replay: unless coins are split first, a transaction that spends pre-fork bitcoin can also confirm on the eCash chain and send the matching ECX to the recipient. The official eCash wallet offers a split tool, and exchanges decide whether to credit ECX. Scams are the other risk, such as claim portals that ask for a seed phrase, which no genuine claim needs.

References / Sources