Transactions

On 10 September 2023, Paxos — a regulated New York financial institution — set out to send 0.074 bitcoin. The transactionA signed message consuming existing UTXOs as inputs and creating new ones as outputs; the only way state ever changes in Bitcoin. its software constructed claimed too little back in outputs, and the protocol did exactly what the protocol does: the 19.8 BTC left unclaimed, roughly $520,000, became the miner's fee. No warning dialogue, no reversal desk, no error code. F2Pool, which mined the blockA batch of transactions plus a header committing to the previous block — the link that makes the chain tamper-evident., returned the money five days later — after identity checks, and as an act of charity, not consensus. Everything in this module is contained in that mistake: what a transaction actually is, where fees really come from, and why the arithmetic of inputs and outputs is the whole game.

Bitcoin has no accounts and no balances. Nothing at the protocol level records that you own 0.5 BTC; there are only discrete unspent transactionA signed message consuming existing UTXOs as inputs and creating new ones as outputs; the only way state ever changes in Bitcoin. outputs — UTXOs — each a lump of value locked to spending conditions, sitting wherever some past transaction left it. The whitepaper defines a coin as a chain of digital signatures, and that is literal: every coin is the latest link in an unbroken chain of signed transfers reaching back to the blockA batch of transactions plus a header committing to the previous block — the link that makes the chain tamper-evident. reward that minted it. Your wallet's "balance" is a fiction of convenience — a sum your software computes by scanning the ledger for outputs its keys can unlock. The chain itself knows nothing of the total. This one inversion — outputs, not accounts — explains almost everything that feels strange about how Bitcoin behaves.

Outputs are spent whole. You can no more spend part of a UTXOUnspent transaction output — a discrete, indivisible coin of arbitrary value. A wallet "balance" is just the sum of the UTXOs its keys can spend. than you can tear the corner off a £10 note and hand it over. Pay £7 with a tenner and you expect £3 back; pay 0.3 BTC from a 1 BTC output and your wallet builds a transactionA signed message consuming existing UTXOs as inputs and creating new ones as outputs; the only way state ever changes in Bitcoin. consuming the entire coin, creating one output of 0.3 to the payee and a second — the changeThe output a transaction sends back to the spender's own wallet, because UTXOs must be consumed whole. — back to a fresh addressA short, checksummed encoding of the conditions for spending — usually a hash of a public key or script. An invoice identifier, not an account. it controls. Change is a wallet convention, not a protocol concept: the network sees only inputs consumed and outputs created, with no idea which output is the payment and which is you paying yourself. That ambiguity matters enormously later, because everyone watching the chain is trying to guess.

The fee is what's left over. Fee = sum of inputs minus sum of outputs — whatever value a transactionA signed message consuming existing UTXOs as inputs and creating new ones as outputs; the only way state ever changes in Bitcoin. fails to claim in outputs falls to the miner of the including blockA batch of transactions plus a header committing to the previous block — the link that makes the chain tamper-evident.. There is no fee field and no safety net, which is precisely how Paxos donated half a million dollars: build the transaction wrong and the difference is simply gone. And fees buy bytes, not value moved. Block space is scarce — roughly a million virtual bytes every ten minutes — so transactions bid a fee rateWhat a transaction bids for block space, in satoshis per virtual byte. Fee = (sum of inputs) − (sum of outputs); miners keep the difference. in satoshis per virtual byte. Moving $1bn in one input-output pair costs the same as moving $10 in the same shape, while a spend gathering dozens of tiny inputs can cost more than one moving a fortune.

Unconfirmed transactions wait in the mempoolEach node's waiting room of valid, unconfirmed transactions — there is no single global mempool, only thousands of similar ones. — not one global queue but thousands of similar ones, each node's private waiting room of valid transactions it has seen and relayed. Miners draw from theirs highest fee rateWhat a transaction bids for block space, in satoshis per virtual byte. Fee = (sum of inputs) − (sum of outputs); miners keep the difference. first, which makes blockA batch of transactions plus a header committing to the previous block — the link that makes the chain tamper-evident. space an auction, and an auction has no fixed price. In early August 2026 every tier on mempool.space sat at 1 sat/vB — the chain that once charged $50 a transactionA signed message consuming existing UTXOs as inputs and creating new ones as outputs; the only way state ever changes in Bitcoin. was, that week, effectively free. In December 2017, in the BRC-20 wave of May 2023, and on halvingThe scheduled 50% cut in new-coin issuance every 210,000 blocks (~4 years), enforcing the 21 million cap. day in April 2024, the same auction cleared in the hundreds of sats per virtual byte. Bid too little and you wait — though a stuck transaction can be replaced with a higher-fee version (RBF), or rescued when its recipient spends it with a high-fee child (CPFP).

The ledger that settles without permission also remembers without mercy, and Satoshi saw both privacy leaks coming in 2008. Section 10 of the whitepaper advises that a new key pair should be used for each payment — address reuseReceiving more than once at the same address — cryptographically allowed, terrible for privacy, and the easiest habit to fix. collapses your history into one publicly watchable cluster — and then concedes the harder problem: multi-input transactions "necessarily reveal that their inputs were owned by the same owner". That sentence is the common-input-ownership heuristic, and an entire chain-surveillance industry is built on it. Spend five UTXOs together and any observer may assume one entity owned all five, merging their histories — the coffee you bought, the exchange that identified you, the donation you thought was anonymous — into a single file with your name pencilled on it.

Which is why coin selectionThe wallet's choice of which UTXOs fund a payment — a trade-off between fees today, fees later, and how much history the inputs reveal. — the choice of which coins fund a payment — is a decision, not a detail. Every custodial user delegates it unknowingly; every self-custodial wallet makes it constantly; good wallets let you make it yourself. The trade-offs are real: consolidating many small UTXOs while fees sit at 1 sat/vB is cheap hygiene that would cost a fortune in a congested mempoolEach node's waiting room of valid, unconfirmed transactions — there is no single global mempool, only thousands of similar ones., but every merge welds histories together under the heuristic above. Hoarding one giant coin broadcasts your whole balance to every counterparty. And the 600 unsolicited sats that appear at your addressA short, checksummed encoding of the conditions for spending — usually a hash of a public key or script. An invoice identifier, not an account. one day may be a dust attack, hoping you will sweep them and link your clusters — the correct response is to label them do-not-spend and move on.