Segregated Witness, specified in BIP141, activated at block 481,824 on 24 August 2017. It was the largest upgrade in Bitcoin's history at the time, and it was a soft fork.
Problem 1: malleability
Before SegWit, a third party could slightly change a signature's encoding without invalidating it. The transaction stayed valid but its txid changed. Any unconfirmed transaction that spent it, by referring to the old txid, would break. That blocked safe off-chain protocols.
SegWit moves signatures and scripts into a separate witness structure that is not part of the txid. A second ID, the wtxid, includes it.
Problem 2: block space
SegWit replaced the 1 MB size limit with a limit of 4,000,000 weight units. Non-witness bytes cost 4 WU, witness bytes cost 1. Old nodes only see the stripped block, which stays under 1 MB, so they keep accepting it. Upgraded nodes see the full block, which can be larger.
How old nodes stay compatible
A SegWit output looks like OP_0 <20 or 32 bytes>. Old nodes see a script anyone can spend with an empty scriptSig, so they accept any spend. New nodes enforce the witness program rules. Blocks commit to the witness data via an OP_RETURN output in the coinbase that contains a hash of the witness merkle root.
Other fixes
- BIP143 changed how signatures are hashed. Signing time grows linearly instead of quadratically, and signers commit to the input amount, which helps hardware wallets.
- Script versioning: the leading opcode (OP_0 to OP_16) is a version number, which made Taproot (version 1) a clean upgrade.
Why it mattered
Without a malleability fix, the Lightning Network would have been impractical. SegWit was activated after a long dispute over block size, which involved BIP148 (a user-activated soft fork) and the Bitcoin Cash split on 1 August 2017.