Skip to content
Financial Context Wiki

UTXO Model

Learn how Bitcoin represents spendable value as unspent transaction outputs, validates spending, creates change, prices transaction space, and exposes coin-selection and privacy trade-offs.

Updated

For educational purposes only; not investment advice. Investing may result in loss.

Direct answer

The unspent transaction output (UTXO) model represents spendable value as distinct outputs rather than as one balance stored against an account. In Bitcoin, an ordinary transaction input identifies a previous output by its transaction identifier and output index. That previous output records an amount and a locking script. A wallet’s displayed balance is a derived total of the outputs it can spend, not a balance field held inside one address.

An output is spent in full. If selected inputs exceed the payment and fee, the transaction must explicitly create a change output; the protocol does not return change automatically. A transaction can consume several existing UTXOs and create several new UTXOs, each with its own amount and spending conditions.

How it works

For an ordinary non-coinbase transaction to be valid, every referenced output must exist and remain unspent, each input must satisfy the referenced output’s locking conditions, and total output value cannot exceed total input value. The difference is available as the transaction fee:

fee = sum(inputs) - sum(outputs)

As a node accepts blocks, it removes consumed outputs from its current UTXO set and adds newly created outputs. The block history remains necessary to verify and rebuild that state. A chain reorganization can replace recent blocks, so outputs near the chain tip may return to unconfirmed status or disappear from the accepted history.

Within one accepted chain history, a particular output can be consumed only once. Conflicting unconfirmed transactions may compete to spend the same output, but mempool admission and replacement are node policies, not the rule that makes an on-chain double spend valid. BIP 125 defines opt-in replacement signaling and policy; receiving an unconfirmed transaction is therefore not final settlement.

Bitcoin block space is priced mainly by transaction weight and fee rate, not by the amount transferred. BIP 141 defines virtual size = ceil(weight / 4). Inputs commonly add more transaction data than outputs, so spending many small UTXOs can cost more than spending one larger UTXO at the same fee rate. Exact size depends on the script and witness types used.

Transactions spending different UTXOs have separate input dependencies, which can make validation and transaction construction easier to parallelize. They are not automatically independent in every implementation or application: two transactions that select the same output conflict, and descendants depend on their unconfirmed parents. Wallet coin selection must coordinate those dependencies.

UTXOs do not provide anonymity. Combining inputs can suggest common control, and change-detection patterns or address reuse can link activity. These are heuristics, not cryptographic proof, but consolidation can expose relationships that separate spends would not reveal.

Compared with an account model, the UTXO model makes each spendable object and its consumption path explicit. Account systems usually update shared account state such as balances and nonces. Neither model is universally superior; they make different trade-offs in state representation, programmability, concurrency, and wallet design.

Worked example

Alice controls UTXOs of 0.08 BTC, 0.12 BTC, and 0.50 BTC. To pay Bob 0.15 BTC, her wallet selects the first two inputs, totaling 0.20 BTC, and estimates a fee of 0.0002 BTC. It creates these outputs:

  • Bob: 0.15 BTC
  • Alice’s change: 0.0498 BTC

The arithmetic is 0.20 - 0.15 - 0.0002 = 0.0498 BTC. Once confirmed, the 0.08 BTC and 0.12 BTC outputs are spent; Bob’s output and Alice’s change are new UTXOs; the 0.50 BTC output remains untouched.

If the transaction created only Bob’s 0.15 BTC output, the omitted 0.05 BTC would be fee, not an automatic refund. A wallet may instead select a different input set, batch several payments, or consolidate small outputs when fee rates are lower. Those choices trade off present fees, future fees, confirmation reliability, and privacy.

Risks and controls

  • Fee risk: fragmented UTXOs add input weight; estimate the signed transaction and its fee rate before broadcast.
  • Privacy risk: input consolidation and recognizable change can link addresses; do not treat a new address as guaranteed unlinkability.
  • Confirmation risk: conflicting transactions, replacement policy, and chain reorganizations make unconfirmed receipts reversible.
  • Recovery risk: the chain stores UTXOs, while the wallet stores or derives the keys and discovery data needed to find and spend them; back up every required recovery factor.

Common misconceptions

An address is a permanent account

An address encodes or represents spending conditions. A wallet can control outputs sent to many receiving and change addresses, so one address is not the wallet’s complete state.

Fees are proportional to the payment amount

Fees depend primarily on transaction weight and the selected fee rate. A large-value payment with few inputs can be smaller and cheaper than a low-value payment assembled from many inputs.

The protocol creates change automatically

Change is an ordinary output deliberately constructed by the spender’s wallet. Any input value not assigned to outputs is available to the miner as fee.

Unconfirmed means settled

A mempool is a node’s provisional view, not a consensus ledger. Acceptance, replacement, and eviction policies vary, and confirmation risk falls over time rather than disappearing at broadcast.

Sources

Navigation

Search the wiki...