Bitcoin Taproot Adoption Metrics: Tracking Schnorr and Script Path Usage Two Years In

Bitcoin Taproot adoption tells two very different stories depending on which metric you measure. Taproot activated at block 709,632 on November 14, 2021, introducing Schnorr signatures, Tapscript, and a unified output format that makes complex spending conditions look identical to simple single-signature payments on-chain. Nearly five years later, P2TR is the most common UTXO type by count, yet it holds less than 1% of the total Bitcoin value in the UTXO set. Understanding how we arrived here, and what the numbers actually reveal about privacy, fees, and protocol maturity, requires separating organic wallet migration from the Ordinals-driven explosion that reshaped the landscape starting in 2023.

What Taproot Changed

Taproot shipped as three interconnected BIPs. BIP 340 defined Schnorr signatures for the secp256k1 curve: 64-byte fixed-length signatures replacing the variable-length DER-encoded ECDSA signatures (71-72 bytes) used by all prior output types. BIP 341 introduced the Pay-to-Taproot (P2TR) output type, combining a key path (spend with a single Schnorr signature) and a script path (reveal one branch of a Merkle tree of scripts) into a single SegWit v1 address format. BIP 342 redesigned the scripting system for Taproot leaves, adding OP_CHECKSIGADD for cleaner threshold checks and enabling future opcode extensions via the success opcode mechanism.

The core design insight: when all parties agree, any spending condition can resolve to a single key path spend regardless of the underlying complexity. A 3-of-5 multisig, a timelocked recovery path, or a DLC oracle contract can all cooperatively close as a 57.5 vbyte input indistinguishable from a wallet sending to a friend. The script path exists as a fallback, not the default path.

Adoption by the Numbers

Taproot adoption metrics have gone through distinct phases, each driven by different forces.

Transaction Share Over Time

For the first year after activation, Taproot adoption was negligible. Wallet support lagged, exchanges were slow to upgrade, and users had little incentive to switch from P2WPKH addresses that already provided SegWit fee savings. By late 2022, P2TR accounted for roughly 1-2% of Bitcoin transactions.

The Ordinals protocol changed everything. Launched in January 2023, Ordinals used Taproot's script path to embed arbitrary data into witness fields. Transaction share surged to a single-day peak of approximately 76% on May 7, 2023 during the inscription frenzy. Through 2024, driven by BRC-20 tokens and the Runes protocol launch at the April 2024 halving, Taproot averaged around 42% of all transactions. As that activity cooled, 2025 settled to approximately 21.68%, with 2026 trending in the 15-20% range.

Count vs. value: Taproot's transaction share is misleading without context. In April 2025, P2TR became the largest UTXO type by count at 59.3 million UTXOs (34.2% of all UTXOs), surpassing both P2PKH (28.8%) and P2WPKH (26.5%). Yet P2TR holds only about 0.75% of total BTC value in the UTXO set. The disparity comes from inscriptions: roughly 72.86% of inscription-related UTXOs are P2TR outputs, and nearly all of them are dust.

The UTXO Set Breakdown

The inscription-related UTXOs account for roughly 29.6% of the entire UTXO set by count. This has implications for state bloat and UTXO consolidation costs, but it also means the raw P2TR adoption number overstates how many users have actually migrated their wallets to Taproot addresses for everyday spending.

Key Path vs. Script Path: Where Are Spends Going?

Taproot's privacy model depends on key path dominance. When most spends use the key path, complex contracts become indistinguishable from simple payments. When script path spends dominate, that anonymity set fractures.

In practice, key path spends account for roughly 60-80% of all P2TR spends, with the ratio shifting based on inscription activity. During Ordinals peaks (which use script path for their commit-reveal pattern), script path spends temporarily dominate. When inscription activity is low, as it has been through much of 2026, key path spending rises to the upper end of that range.

Why Key Path Spending Matters

• Key path spends are the smallest possible input at 57.5 vbytes, saving fees for every participant who uses them.
• They reveal nothing about alternative spending conditions. An observer cannot tell whether the output had a script tree, how many branches it contained, or what conditions they encoded.
• Protocols like MuSig2 and FROST produce standard Schnorr signatures for the key path, making multisig and threshold setups indistinguishable from single-sig on-chain.
• Batch verification of Schnorr signatures is asymptotically faster than verifying individual ECDSA signatures, improving node performance during initial block download.

Script Path Usage Patterns

Script path spends serve legitimate purposes beyond inscriptions. Taproot Assets uses script path commits for asset metadata. Miniscript within Taproot leaves (supported since Bitcoin Core v26.0) enables complex custody policies with fallback recovery paths. And simple taproot channels on Lightning use the script path for force-close scenarios while resolving cooperatively via the key path.

The challenge is that inscription-driven script path usage has made it harder to analyze how much of the script path traffic is "organic" protocol activity versus data embedding. As inscription volumes have declined from their 2023-2024 peaks (over 127 million total inscriptions by late 2025, generating 6,901 BTC in fees), the script path ratio has normalized, but the data is still noisy.

Wallet Support: Who Has Upgraded?

Wallet defaults are the single biggest driver of long-term adoption. Until major wallets change their default address type from P2WPKH to P2TR, organic Taproot adoption will remain gradual. Here is where the ecosystem stands.

Among major exchanges, Binance, Coinbase, Kraken, and OKX all support sending to Taproot (bech32m) addresses, but none generate P2TR deposit addresses for customers by default. Exchange migration would represent a massive shift in on-chain composition, but exchanges are conservative about address type changes due to support ticket overhead and integration complexity with existing indexer and explorer infrastructure.

The default-address bottleneck: Muun remains one of the only widely used wallets defaulting to P2TR. Until Bitcoin Core, Ledger, or a top-10 exchange changes their default, Taproot adoption will continue to be driven by protocol-level usage (inscriptions, Taproot Assets, Lightning channels) rather than everyday wallet spending.

Fee Savings: Does Taproot Actually Save Money?

The fee savings story depends on the transaction structure. For single-input, single-output payments, P2TR is actually slightly larger than P2WPKH because Taproot outputs use a 32-byte x-only public key rather than a 20-byte pubkey hash. But for transactions with multiple inputs, the per-input savings compound, and for multisig setups, the difference is dramatic.

Input Size Comparison

Each P2TR key path input saves 10.5 vbytes over P2WPKH: a 15.4% reduction per input. For a transaction consolidating 10 UTXOs, that is 105 fewer vbytes, which at 50 sat/vB translates to 5,250 fewer satoshis in fees.

Multisig: Where Taproot Transforms Economics

The most compelling fee argument for Taproot is in multisig and threshold signing. Traditional P2WSH multisig reveals every public key and signature on-chain. A 2-of-3 P2WSH input weighs approximately 104.5 vbytes. A 2-of-3 setup using MuSig2 or FROST produces a single Schnorr signature for the key path: 57.5 vbytes regardless of the threshold or total signer count. That is a 45% reduction compared to P2WSH, and an 80% reduction compared to legacy P2SH multisig (~296 vbytes).

This is not a theoretical saving. Custody providers managing thousands of UTXOs across multisig policies see direct cost reductions when migrating to key-aggregated Taproot outputs.

Privacy Implications: The Uniformity Promise

Taproot's original privacy argument was compelling: if every output looks the same on-chain, you cannot distinguish a Lightning channel open from a cold storage deposit, a DLC settlement from a payroll payment. The anonymity set would be all P2TR outputs.

The reality is more nuanced. Four years in, P2TR outputs are not uniform. Chain analysis firms can still apply heuristics based on timing, amounts, change output patterns, and whether the spend used a key path or script path. The inscription boom created a large population of P2TR outputs that are trivially identifiable as inscription-related based on their dust values and script path witness structure.

Still, the key path uniformity benefit is real for protocols that consistently use it. A cooperative Lightning channel close via a simple taproot channel is indistinguishable from a wallet-to-wallet payment. A threshold-signed custody withdrawal looks identical to someone spending from a mobile wallet. As key path adoption grows among organic users (not just inscription protocols), the anonymity set for key path spends strengthens.

Lightning and Taproot Channels

Lightning implementations have made significant progress on Taproot integration. LND graduated simple taproot channels from experimental to production-ready in v0.21.0-beta (June 2026). Eclair shipped taproot channels enabled by default in v0.14.0 (May 2026). The specification became an official extension BOLT in May 2026 via BOLTs PR #995.

The privacy benefit is straightforward: cooperative channel closes use MuSig2 to produce a single key path spend, making the on-chain footprint indistinguishable from any ordinary P2TR single-sig transaction. Force closes still reveal the script path (including HTLC branches), but the majority of Lightning channels close cooperatively.

Taproot Assets adds another dimension. Lightning Labs released Taproot Assets v0.6 in June 2025, enabling multi-asset channels on Lightning. Tether announced USDT issuance on Lightning via Taproot Assets in early 2025. These protocols further increase P2TR's on-chain footprint while leveraging its script path for asset commitment metadata.

How Spark Benefits from Taproot Adoption

Spark is a direct beneficiary of Taproot's privacy properties. Spark transactions settle on Bitcoin using Taproot outputs, with the FROST threshold signature between the user and Spark operators producing a standard BIP 340 Schnorr signature for the key path. On-chain, a Spark deposit, transfer exit, or cooperative close is a 57.5 vbyte key path spend: indistinguishable from a regular single-sig wallet transaction.

This matters because Spark's trust model involves multiple independent operators collectively managing one side of a two-of-two signing setup. Without Taproot, this would require exposing multiple public keys and signatures on-chain via P2WSH, revealing the protocol's presence. With Taproot and FROST (formalized as IETF RFC 9591 in June 2024), the threshold, the number of operators, and even the fact that a Layer 2 protocol was involved remain invisible. Every additional wallet and exchange that adopts P2TR as their default address type grows the anonymity set that Spark transactions blend into.

FROST vs. MuSig2: FROST enables t-of-n threshold signing (any t signers from n can produce a valid signature), while MuSig2 requires all n signers to participate. For Spark, FROST is essential because not every operator needs to be online for every transaction. Both produce standard Schnorr signatures indistinguishable from single-key spends.

What Would Accelerate Adoption

Several developments could shift the adoption curve beyond the current plateau.

Wallet Defaults

The single highest-impact change would be Bitcoin Core switching its default new wallet type to P2TR. Since many downstream wallets and libraries follow Core's conventions, this would cascade through the ecosystem. The BIP 86 derivation path for single-key P2TR is well-established, and the tooling is mature. The main hesitation is backward compatibility: some older software and services still do not recognize bech32m addresses.

Exchange Migration

Exchanges control a disproportionate share of on-chain transaction volume. When a major exchange switches deposit addresses to P2TR, it moves the needle more than hundreds of wallet updates. The infrastructure requirements are well-understood, and the fee savings on UTXO consolidation sweeps (which exchanges perform regularly) provide a direct financial incentive.

Cross-Input Signature Aggregation

A future soft fork enabling cross-input signature aggregation would make Taproot's fee advantage even more pronounced. Instead of one Schnorr signature per input, a transaction could carry a single aggregate signature for all inputs, reducing witness size further. Batch verification of Schnorr signatures already improves validation performance; aggregation would extend those gains to on-chain data size.

The Quantum Question

In early 2026, a proposal emerged to remove Taproot's key path spend entirely as a quantum resistance measure. The reasoning: key path spends expose the public key directly in the output (as an x-only 32-byte key), whereas hash-based output types like P2WPKH hide the public key behind a hash until spend time. If quantum computers capable of breaking elliptic curve cryptography emerge, P2TR outputs would be vulnerable while unspent.

The proposal sparked debate. Removing key path spends would eliminate Taproot's primary privacy benefit, increase transaction sizes, and break every protocol built on key path uniformity. Most developers consider the timeline for quantum threats to be long enough that post-quantum cryptography can be introduced through new output types rather than removing existing ones. For now, the key path remains the foundation of Taproot's value proposition.

Measuring What Matters

Raw P2TR transaction share is a poor proxy for meaningful Taproot adoption. A more useful framework separates three distinct adoption vectors.

• Protocol adoption: Lightning taproot channels, Taproot Assets, Ordinals/Runes, and Layer 2 settlement (Spark, Ark, statechains). This is the most advanced vector and accounts for most current P2TR activity.
• Wallet adoption: end users generating P2TR receive addresses for everyday payments. This remains slow due to wallet defaults but is the metric that most directly improves the privacy anonymity set.
• Infrastructure adoption: exchanges, payment processors, and custodians using P2TR for deposits, withdrawals, and internal sweeps. This is the largest untapped opportunity by transaction volume.

The privacy benefits of Taproot only fully materialize when all three vectors converge. Protocol adoption alone creates a large P2TR output set, but if those outputs are overwhelmingly identifiable as inscriptions or channel opens, the anonymity set is weaker than the numbers suggest. Wallet and infrastructure adoption are what make key path spends truly private by mixing them with ordinary spending activity.

For developers building on Taproot, the Spark SDK documentation covers how FROST threshold signing integrates with P2TR outputs, and the P2TR spend path deep dive breaks down key path and script path mechanics at the byte level. For a broader look at how Taproot fits into the address type evolution, see the Bitcoin address types comparison.

This article is for educational purposes only. It does not constitute financial or investment advice. Bitcoin and Layer 2 protocols involve technical and financial risk. Always do your own research and understand the tradeoffs before using any protocol.