Bitcoin: the UTXO model

Transferring money at a bank means changing one row in a database: minus for the sender, plus for the recipient. Satoshi Nakamoto rejected this model. Bitcoin has no 'balance' row, no account, no table of balances. Instead there are indivisible digital banknotes, each existing until the moment it is spent. This model is called UTXO, and it determines everything: from transaction structure to fee costs to user privacy.

• **Bitcoin Core** keeps a UTXO Set of ~180M entries in RAM on every full node for instant double-spend checking
• **Cardano** - the third-largest blockchain platform by market cap - uses an extended UTXO model (eUTXO), adding smart contract data to outputs
• **Lightning Network** - the Bitcoin instant-payment protocol - is built on top of UTXOs: each payment channel is a UTXO locked with a multisig script

Предварительные знания

• What is Blockchain

UTXO Set: a wallet is a set of banknotes

When you open a banking app and see 'Balance: $500', what's behind the scenes is a simple database record - a single number. Ethereum works the same way: each address has a `balance` field. This is the **account model**.

Bitcoin works on a different model. In the Bitcoin network **there is no such thing as a 'balance'**. There is no row in a table with your address and a number. Instead there are **UTXO - Unspent Transaction Outputs**.

Imagine a physical wallet. It doesn't hold an abstract number like '$50', but concrete banknotes: one $20, two $10s, and two $5s. Each note is a separate object with a denomination. **UTXOs are such digital 'banknotes'**. Your 'balance' is the sum of all UTXOs you can spend.

**UTXO Set** is the complete set of all unspent outputs across the entire Bitcoin network. Every full node keeps this collection in memory, because it defines who can spend how much right now. As of 2025 the UTXO Set contains **roughly 180 million entries** and occupies about **7-8 GB** of RAM.

**Key UTXO property:** each UTXO can only be spent **in full** - like a banknote. You can't 'tear off a piece' of a 1.2 BTC UTXO and spend 0.5. The entire UTXO goes into the transaction input, and if needed, change is created.

Inputs and Outputs: anatomy of a transaction

A Bitcoin transaction is not a 'transfer of N coins from A to B'. It is **the destruction of old UTXOs and the creation of new ones**. Each transaction has **inputs** and **outputs**.

**Input** - a reference to an existing UTXO being spent. Contains the `tx_id` and `output_index` of the previous transaction, plus the owner's signature proving the right to spend. **Output** - a new UTXO being created. Contains an amount and a `scriptPubKey` (the condition under which this UTXO can be spent - usually tied to the recipient's address).

The critical rule: **sum of inputs >= sum of outputs**. The difference between the total inputs and total outputs is the **transaction fee**, which goes to the miner. There is no dedicated 'fee' field in the transaction - the fee is calculated implicitly.

**Double spend:** if a UTXO has already been spent in another transaction - a node will reject the transaction. The UTXO Set lets nodes quickly check: 'does this output still exist or has it been spent?' - in O(1) via hash table lookup.

Change: getting change in Bitcoin

You buy a coffee for $2.50. You have a $10 bill. You hand over $10 and get $7.50 in change. Bitcoin works exactly the same way.

Suppose Alice has one UTXO of **10 BTC** and wants to send Bob **3 BTC**. A UTXO cannot be 'split' - it is spent in full. So Alice creates a transaction with **two outputs**: 1. **3 BTC → Bob** (payment) 2. **6.99 BTC → Alice** (change - **change output**) 3. The remaining 0.01 BTC → miner (fee)

**Change output** is a new UTXO sent **back to yourself** at your own address. Wallets typically generate a **new change address** so that an outside observer cannot immediately tell which output is the payment and which is the change.

**A common beginner mistake:** forgetting to create a change output. If Alice sends a transaction with a 10 BTC input and a single 3 BTC output - the remaining **7 BTC go to the miner as a fee**. In 2013 a user accidentally paid 200 BTC in fees on a 1 BTC transaction for exactly this reason.

**Dust UTXO:** if the change is too small (e.g., 546 satoshis - the current dust limit), it is cheaper to give it as extra fee than to create a separate output. Creating and later spending such a tiny UTXO costs more than the UTXO itself.

Coin Selection: which UTXOs to spend?

Alice has 50 UTXOs of various sizes - from 0.001 BTC to 2.0 BTC. She needs to send 1.5 BTC. Which UTXOs should she use as inputs? This is the **coin selection** problem - and it affects the fee size, privacy, and the amount of dust in the UTXO Set.

Why does it matter? In Bitcoin the fee depends on the **transaction size in bytes**, not on the transfer amount. Each input adds ~68 bytes (for P2WPKH). The more inputs, the more expensive the transaction. So UTXO selection directly affects cost.

**Branch and Bound (BnB)** - the algorithm used in Bitcoin Core since version 0.17 (2018). It enumerates UTXO combinations, trying to find a set whose sum **exactly equals** the payment amount + fee. If such a combination exists, no change output is needed - saving ~30 bytes and improving privacy (an observer cannot tell which output is the payment vs change if there is no change).

**UTXO Consolidation** - a technique where during periods of low fees a user merges many small UTXOs into one large one. A transaction is created with many inputs and one output to one's own address. This is a 'wallet cleanup' - later, when fees are high, you can spend a single large UTXO instead of dozens of small ones.

**Scale of the problem:** the global UTXO Set grows with every block. Each full node keeps it in RAM for fast validation. If the UTXO Set becomes too large - the barrier to running a full node rises. That's why consolidation and efficient coin selection matter for the health of the whole network.

Summary

• **UTXO (Unspent Transaction Output)** - Bitcoin's digital 'banknotes'. There is no balance - only a set of unspent outputs. Satoshi rejected the banking model of 'one row = one balance' in favor of a model where each 'banknote' exists until it is spent
• **Transaction = destruction of old UTXOs + creation of new ones.** An input references a previous UTXO and spends it in full. An output creates a new UTXO. The difference sum(inputs) - sum(outputs) = miner fee
• **Change output** is the change. A UTXO cannot be partially spent. If a UTXO = 10 BTC but you want to send 3 - a change output of 6.99 BTC is sent back to yourself. Forgetting change = giving the difference to the miner
• **Coin selection** determines the cost and privacy of a transaction. Bitcoin Core uses **Branch and Bound** - an algorithm that seeks a UTXO combination with no change, saving bytes and making blockchain analysis harder

Related topics

The UTXO model is the foundation of all Bitcoin transaction mechanics:

• Introduction to blockchain — Basic blockchain concepts on which the understanding of UTXO is built
• Bitcoin Script — The scriptPubKey in each UTXO defines the spending conditions - from simple P2PKH to multisig and timelocks
• Ethereum: account model — An alternative approach to state storage - with a global balance instead of UTXOs, which simplifies smart contracts but changes the parallelism model

Вопросы для размышления

• Why did Satoshi Nakamoto choose the UTXO model instead of the familiar account model? What properties (privacy, parallelism, validation) does it handle better?
• If all Bitcoin users stopped doing UTXO consolidation, and every transaction created a tiny change output - how would this affect the UTXO Set and the cost of running a full node?
• Imagine you are building a privacy wallet. Which coin selection strategy would you choose and why? How would you resolve the conflict between saving on fees and preserving privacy?

Связанные уроки

• db-03-acid