Nested SegWit

In 2017 hardly any exchange could parse a bech32 address, so BIP-141 allowed a witness program to sit inside an ordinary pay to script hash output. The result looks like any other 3 address to a sender and spends for about 91 vbytes, against 148 for a legacy input and 68 for a plain bc1q one. It was a bridge, and the crossing has been open for years.

How it works

A nested SegWit output is an unremarkable P2SH output: OP_HASH160, a 20-byte hash, OP_EQUAL. What sits behind the hash is unusual. The redeem script is not really a script at all but the 22-byte witness program itself, the version byte 0x00 followed by a push of the 20-byte HASH160 of your compressed public key.

Spending therefore uses both worlds. The scriptSig holds exactly one item, that 22-byte program, which satisfies the P2SH check. The signature and public key go into the witness, where they earn the discount. Add the push opcode and the scriptSig contributes 23 non-witness bytes weighing 92 units, and 92 divided by four is the whole 23 vbyte penalty against native SegWit.

Wallets keep these addresses on their own branch. BIP-49 assigns the derivation path m/49'/0'/0', and SLIP-132 gave that branch the ypub extended key prefix, which is how restoring a backup produces 3 addresses rather than bc1q ones. Getting the prefix wrong during a restore shows an empty wallet even though the seed is correct.

Where you see it

Any deposit or withdrawal screen offering "SegWit" and "Native SegWit" as separate choices is offering nested and native in that order. Ledger and Trezor account setup screens do the same. Exchanges that adopted SegWit early standardized on the nested form and many never changed, so a large amount of custodial cold storage still lives behind 3 addresses.

Moving to native SegWit is an on-chain transaction, not a settings change, because the two formats come from different branches of the same seed. Do it when fees are low, send a small test first, and check afterwards that your wallet is displaying the m/84'/0'/0' account. There is no security difference between the two, so nothing is urgent. The trade is purely fees against compatibility, and compatibility stopped being scarce.

Nested SegWit vs P2SH address

Nested SegWit is one kind of P2SH address, and on chain the two are impossible to tell apart until a spend. A string beginning with 3 might commit to a 22-byte witness program, to a 2-of-3 multisig redeem script, or to a timelocked recovery clause, and the unspent output gives away nothing. That opacity once counted as a privacy benefit. In practice it now means a block explorer cannot tell you what you are holding, and a sender cannot warn you that the address will cost more to empty than a bc1q one would.