PTLC

Point time-locked contracts do the job of an HTLC without a shared hash: every hop gets its own lock, derived from a curve point. They rest on Schnorr adaptor signatures, which became practical on bitcoin when Taproot activated at block 709,632 in November 2021. For a payer, the gain is that routing nodes can no longer spot the same payment passing through two of their machines.

How it works

An adaptor signature is a signature with one piece deliberately missing, and the missing piece is the payment secret.

Start from the receiver, who picks a secret number and publishes only the curve point it corresponds to. Under BIP340 Schnorr rules, a payer can build a signature that is invalid on its own but becomes valid the instant that secret number is added. Publishing the completed signature therefore leaks the number, and leaking the number is what lets the previous hop complete its own signature and claim its money. The domino effect is identical to an HTLC's, but nothing is hashed and nothing is shared.

The privacy comes from tweaking. The payer adds a random offset to the point at every hop and tells each node its offset inside the onion packet, so hop three and hop seven are looking at two unrelated points for one payment. That closes the correlation leak, and it also closes the wormhole attack, where two colluding hops on the same route skip the honest nodes between them and pocket their routing fees. Neither fix is possible while a single hash travels the whole path.

There is a bonus that matters in disputes. With a hash contract, the preimage proves a payment happened but says nothing about who made it, so it is weak evidence. A point contract produces a signature that only the payer's own key could have produced against that invoice, which is a proof of payment in the ordinary sense of the phrase.

Where you see it

You do not see PTLCs yet, and being honest about that is the point of this entry.

Taproot supplied the ingredients, and Taproot channels have shipped in the major Lightning implementations, but those channels still route hash contracts. The remaining work is protocol plumbing: onion payloads that carry per-hop tweaks, updated commitment transactions, and agreement across implementations that all have to interoperate. Until that lands, any wallet describing itself as private on Lightning is talking about onion routing, not about unlinkable hops.

What it means for someone buying bitcoin is modest and specific. If you keep a Lightning balance and you care that a large routing operator cannot build a picture of your spending, PTLCs are the upgrade to watch for in your wallet's release notes. Nothing about your keys, your seed backup, or your on-chain coins changes when they arrive.

PTLC vs HTLC

PTLCs and HTLCs buy the same guarantee, atomic multi-hop payment, and differ in what the intermediate nodes learn. A hash contract broadcasts one identifier along the entire route; a point contract gives each hop a value that looks random to it. The practical reading: HTLCs are today's Lightning and work fine, PTLCs are strictly better on privacy and on proof of payment, and the switch is a spec and implementation problem rather than a bitcoin consensus problem, because Taproot already did the consensus part.