What is Taproot?

The 2021 Bitcoin upgrade that added Schnorr signatures and a new script layout, letting complex spending conditions look like ordinary single-key payments on chain.

It was defined by BIP-340, BIP-341, and BIP-342 and activated in November 2021 (source: BIP-341). The privacy gain is that a multisignature wallet or a timelocked contract can settle in a form indistinguishable from a plain payment when everyone cooperates, and only the branch actually used is ever revealed. Taproot outputs also carry the witness data that ordinals and runes later used. Support is per-wallet: an exchange withdrawal to a Taproot address fails if that exchange has not added it. See schnorr signature and multisig.

For most holders the visible surface is the address format. Taproot addresses begin with bc1p, and sending to one from a venue that has not implemented them simply does not work.

How it works

Three specifications did three distinct things.

BIP-340 introduced Schnorr signatures to Bitcoin. Their useful property is linearity: several public keys can be combined into one, and several signatures into one, so a group signing together produces an output that looks exactly like a single signer (source: BIP-340).

BIP-341 defined the output type and the script tree. A Taproot output commits to one key path and to a tree of alternative script paths. Spending by the key path publishes only a signature. Spending by a script path publishes only the branch used, plus a proof it belonged to the tree, and every other branch stays private (source: BIP-341).

BIP-342 defined the scripting rules for those script paths.

The combination is why a two-of-three arrangement whose participants all agree can settle in a transaction indistinguishable from a plain payment, and why the fallback conditions nobody used are never revealed. Activation occurred at block 709,632 in November 2021 (source: BIP-341).

Example

Illustrative. A wallet is set up so that either three named people signing together can spend, or after one year a single backup key can. Under the older approach, spending in the cooperative case would publish the whole arrangement, showing anyone who looked that a three-party wallet with a timelocked backup exists. Under Taproot, the cooperative spend publishes one signature and one key, and looks like any other payment. The timelocked backup branch is never revealed to anyone, because it was never used.

Why it matters when you buy

The practical issue is address support on withdrawals. Not every exchange sends to bc1p addresses, and a withdrawal to an unsupported format is rejected or, on some venues, sits in a failed state until support intervenes. The exchange pages cover what each venue supports, and the guide on moving crypto off an exchange covers checking before you send.

Related terms

• schnorr signature — the signature scheme Taproot added
• multisig — the arrangement it makes invisible
• segwit — the earlier upgrade it builds on
• soft fork — how it was deployed
• ordinals — what its witness space was later used for
• address — where the change is visible to a user

Questions

Do I need to use a Taproot address?

No. Older address formats still work. Taproot addresses can be cheaper to spend from in some cases and offer the privacy properties described here, and they require support on both ends.

Did Taproot change Bitcoin's supply or rules for holders?

No. It tightened validity rules as a soft fork. Balances, addresses, and the issuance schedule were untouched, and no action was required of any holder.

Why do some exchanges still not support it?

Address support is engineering work on each venue's withdrawal and deposit systems, and it is prioritized against everything else. The venue's own support pages state which formats it handles.