The UTXO model

Wonder

1. What happens to a balance when there are no accounts to update?
2. How does a node verify that an input was not already spent without checking every previous transaction?
3. Why does carrying a coin’s full history make it harder to remain anonymous?

Explore

1. Bitcoin does not use the account model of bank ledgers and Ethereum. In those systems, balances are stored at addresses and updated in place; sending funds subtracts from one balance and adds to another. Bitcoin has no such storage. Instead, it uses a cash-like structure where value exists only as discrete, unspent units. There is no central ledger tracking ‘Alice’s total’; there is only a set of individual outputs that are currently available for spending.
2. These units are called Unspent Transaction Outputs (UTXOs). Each UTXO holds a specific amount in satoshis and a locking script that defines who can spend it. When a transaction occurs, it consumes entire UTXOs as inputs and creates new UTXOs as outputs. The outputs it spends leave the set of spendable coins (the transactions remain in the chain’s history), and the new outputs join it. A wallet’s ‘balance’ is not a stored number but the sum of all UTXOs whose locking scripts its private keys can satisfy.
3. This structure simplifies validation for network nodes. Because each input references a specific, previously unspent output, a node only needs to check that this particular output exists in the current state and has not been used before. It does not need to recalculate global balances or verify complex account histories. Every full node maintains the ‘chainstate,’ which is essentially the entire set of all active UTXOs at any given moment. This allows for fast, deterministic verification of double-spending attempts.
4. The contrast with Ethereum highlights a key design choice. Ethereum uses an account model where each address has a stored balance and a nonce (a transaction counter) to prevent replay attacks. Updating an account requires changing the state tree globally. Bitcoin creates new outputs rather than editing balances in place, which means coins carry their history, linking past transactions to current holdings.
5. This historical linkage has significant implications for privacy and fungibility. Because every input points back to a previous output, analysts can trace the flow of funds through chains of UTXOs. While mixing services and other techniques exist, the fundamental structure makes it difficult to completely sever the link between a coin’s origin and its current holder. This transparency is often cited in debates about whether bitcoins are truly fungible, as some market participants may prefer ‘clean’ coins with less traceable history.
6. To see this in action, open the coin-control (or ‘UTXO’) view of a wallet that has received several payments: it lists each output separately, with its own value and transaction ID. On a block explorer, an address page shows the same thing as a list of received outputs, some spent and some not. This list of individual outputs is the true on-chain representation of ownership; the ‘balance’ shown in the interface is merely a client-side calculation derived from this set.

Key facts

Exercise nine, six, three, one

Fact check

Dates, figures and claims checked against the published sources listed below.

• Satoshi Nakamoto, 'Bitcoin: A Peer-to-Peer Electronic Cash System' (2008), sections 2 and 9
• A. M. Antonopoulos & D. A. Harding, Mastering Bitcoin, 3rd ed. (2023), ch. 6
• Bitcoin Developer Guide, 'Transactions' (bitcoin.org)