Adaptor Signature

An adaptor signature is a cryptographic construction that ties the publication of a valid signature to the revelation of a hidden secret. Informally, it is a promise with a tripwire: one party produces an incomplete "pre-signature" that is verifiably bound to a secret value, and the moment the completed signature appears on-chain, anyone holding the pre-signature can compute the secret from the difference. Payment and disclosure become a single atomic event, which turns out to be enough machinery to build a surprising amount of contract logic out of nothing but signatures.

How the mechanism works

The idea rides on the algebra of Schnorr signatures (constructions exist for ECDSA, but Schnorr's linearity makes them clean). The secret is a scalar t whose public point T = tG anyone can see. The signer produces a pre-signature that verifies only "offset" by T: it is not a valid signature yet, but a verifier can confirm that adding the unknown t would complete it. When the signer later wants the money, they must publish the completed signature, and subtracting the pre-signature from it yields t exactly. The signature cannot become valid without leaking the secret; the secret cannot stay hidden if the coins move. No new opcodes, no special transaction type, just arithmetic.

Scriptless scripts

Adaptor signatures are the foundational building block of scriptless scripts, an approach pioneered by Andrew Poelstra that enforces contract conditions through the algebraic properties of signatures rather than through explicit Bitcoin Script opcodes. Because the contract logic lives entirely in the signature math, an outside observer sees only a normal-looking single-signature spend, indistinguishable from millions of ordinary payments. This improves privacy, since sophisticated conditional contracts leave no on-chain fingerprint, and it reduces weight and fees, since no script conditions are published. With Taproot making Schnorr the native signature scheme, every ordinary-looking key-path spend is potentially a completed contract no one else can identify as one.

Atomic swaps and Lightning

The canonical application is the atomic swap: two parties lock funds on two chains and construct adaptor signatures around the same secret, so that claiming the coins on one chain unavoidably reveals the value the counterparty needs to claim on the other. The trade is all-or-nothing with no trusted intermediary and, done with adaptor signatures rather than hash-locked scripts, no telltale on-chain pattern linking the two legs. The same mechanism yields PTLCs, point time-locked contracts, the intended successor to the HTLCs that route Lightning Network payments today. HTLCs reuse one hash preimage along the whole route, letting colluding nodes correlate a payment across hops; PTLCs re-randomize the secret point at every hop, so each link looks unrelated, closing that correlation channel and hardening against certain routing attacks. Adaptor signatures also compose naturally with multi-party signing schemes such as MuSig2 and FROST, embedding secret-revealing conditions inside what appears to be a single aggregate signature.

Why it matters

For sovereign users, adaptor signatures represent a quiet philosophical win: contracts enforced by mathematics rather than by publishing your business logic to the world. Less data on-chain, less metadata for surveillance, fewer distinguishable transaction types to censor, and cross-chain settlement that needs no custodian. The cryptography does the enforcement, and the blockchain only ever sees a signature.

The same primitive powers discreet log contracts (DLCs), in which two parties bet on a real-world outcome using signatures published by an oracle: the oracle's attestation acts as the secret that completes one side's adaptor signature, settling the contract without the oracle ever knowing it was referenced, and without the contract appearing on-chain as anything but an ordinary spend. It is a recurring pattern in modern Bitcoin engineering: rather than adding expressive power to the blockchain, move the expressiveness into cryptography that the chain never needs to see.