MSTR Cat

Blockchain/Level II · Mechanics/2.2 Transactions/Lesson 4

Change outputs

The remainder that reveals the sender, and the algorithms that try to hide it

MaterialsA block explorer (e.g., mempool.space or blockchain.com)A Bitcoin wallet with at least two UTXOsA spreadsheet to log transaction IDs, input values, and output structures

Wonder

  1. Why does a transaction paying an exact amount often look different from one requiring change?
  2. How can an analyst determine which output is payment and which is change without seeing the wallet’s internal state?
  3. What drives a coin-selection algorithm to prefer a slightly higher fee over a lower one?

Explore

  1. Bitcoin transaction inputs function like indivisible physical currency notes. If Alice intends to pay 5 BTC but holds only a single UTXO of 20 BTC, she cannot divide the input. She must spend the full 20 BTC and receive 15 BTC back as change, after accounting for fees. Consequently, most transactions include two outputs: one for the recipient and one for the return of change.
  2. At the protocol level, there is no distinction between a ‘payment’ output and a ‘change’ output. Both are standard locking scripts, such as P2PKH or P2WPKH, awaiting spending conditions. The transaction creator alone knows which output is which. This lack of differentiation is a core privacy mechanism: if a change address and payment address appear identical, external observers cannot conclusively differentiate them.
  3. Wallets use coin-selection algorithms to determine which inputs to spend. If Alice holds two UTXOs of 50,000 satoshis and wishes to pay Bob 85,000 satoshis, she spends both inputs (100,000 sats) and creates two outputs: one for Bob (85,000 sats) and one for herself (15,000 sats minus the fee). This shape, one or more inputs and exactly two outputs, is among the most common on the chain.
  4. For privacy, it is standard to assign change to a new, never-before-used address from the wallet’s key pool. Reusing an old address for change enables chain analysts to connect prior transaction activity to the new one. In optimal cases, both the payment and change outputs are assigned to fresh addresses, ensuring they appear identical to external observers.
  5. Not every payment needs change. Coin-selection algorithms such as Branch and Bound, described by Mark Erhardt in 2016 and used in Bitcoin Core, search for a set of inputs whose total matches the payment plus fee closely enough that the small leftover can simply go to the fee. A changeless transaction is cheaper, creates no new small output, and gives analysts one less clue.
  6. Very small outputs create their own problem. Below the dust threshold (by default about 546 satoshis for P2PKH outputs and 294 for P2WPKH), an output costs more to spend than it is worth, and nodes will not relay transactions that create one. Analysts also look for telltale change patterns: the round-number output is usually the payment, and an output whose address type matches the inputs is often the change.

Key facts

  • Transaction inputs are indivisible; a leftover beyond the payment and fee is returned as change, unless it is small enough to add to the fee.
  • At the protocol level, there is no technical difference between a change output and a payment output; only the transaction creator knows which is which.
  • Branch and Bound coin selection (Erhardt, 2016) looks for input sets that need no change output.
  • Changeless transactions have no output returning funds to the sender; any small leftover goes to the fee.
  • Using a new, never-before-seen address for change prevents third parties from easily distinguishing it from a payment output.
  • Bitcoin Core’s default dust threshold is about 546 satoshis for P2PKH outputs and 294 for P2WPKH.

Exercise nine, six, three, one

9CollectList 9 recent Bitcoin transactions you have observed or created. Note the number of inputs and outputs for each, and whether a change output was present.
6ClusterGroup the 9 into 6 categories based on their structure: single-input/single-output, multi-input/two-output (change), multi-input/single-output (no change), coinbase, OP_RETURN, or other complex structures.
3DistillReduce the 6 groups to 3 distinct privacy implications regarding how easily an analyst can link outputs to a specific user identity.
1CrystallizeWrite 1 sentence explaining why the absence of a technical distinction between payment and change outputs is both a feature for fungibility and a challenge for individual privacy.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS