Transactions

On 10 September 2023, Paxos — a regulated New York financial institution — set out to send 0.074 bitcoin. The transaction its software constructed claimed too little back in outputs, and the protocol did exactly what the protocol does: the 19.8 BTC left unclaimed, roughly $520,000, became the miner's fee. No warning dialogue, no reversal desk, no error code. F2Pool, which mined the block, returned the money five days later — after identity checks, and as an act of charity, not consensus. Everything in this module is contained in that mistake: what a transaction actually is, where fees really come from, and why the arithmetic of inputs and outputs is the whole game.

Bitcoin has no accounts and no balances. Nothing at the protocol level records that you own 0.5 BTC; there are only discrete unspent transaction outputs — UTXOs — each a lump of value locked to spending conditions, sitting wherever some past transaction left it. The whitepaper defines a coin as a chain of digital signatures, and that is literal: every coin is the latest link in an unbroken chain of signed transfers reaching back to the block reward that minted it. Your wallet's "balance" is a fiction of convenience — a sum your software computes by scanning the ledger for outputs its keys can unlock. The chain itself knows nothing of the total. This one inversion — outputs, not accounts — explains almost everything that feels strange about how Bitcoin behaves.

Outputs are spent whole. You can no more spend part of a UTXO than you can tear the corner off a £10 note and hand it over. Pay £7 with a tenner and you expect £3 back; pay 0.3 BTC from a 1 BTC output and your wallet builds a transaction consuming the entire coin, creating one output of 0.3 to the payee and a second — the change — back to a fresh address it controls. Change is a wallet convention, not a protocol concept: the network sees only inputs consumed and outputs created, with no idea which output is the payment and which is you paying yourself. That ambiguity matters enormously later, because everyone watching the chain is trying to guess.

The fee is what's left over. Fee = sum of inputs minus sum of outputs — whatever value a transaction fails to claim in outputs falls to the miner of the including block. There is no fee field and no safety net, which is precisely how Paxos donated half a million dollars: build the transaction wrong and the difference is simply gone. And fees buy bytes, not value moved. Block space is scarce — roughly a million virtual bytes every ten minutes — so transactions bid a fee rate in satoshis per virtual byte. Moving $1bn in one input-output pair costs the same as moving $10 in the same shape, while a spend gathering dozens of tiny inputs can cost more than one moving a fortune.

Unconfirmed transactions wait in the mempool — not one global queue but thousands of similar ones, each node's private waiting room of valid transactions it has seen and relayed. Miners draw from theirs highest fee rate first, which makes block space an auction, and an auction has no fixed price. In early August 2026 every tier on mempool.space sat at 1 sat/vB — the chain that once charged $50 a transaction was, that week, effectively free. In December 2017, in the BRC-20 wave of May 2023, and on halving day in April 2024, the same auction cleared in the hundreds of sats per virtual byte. Bid too little and you wait — though a stuck transaction can be replaced with a higher-fee version (RBF), or rescued when its recipient spends it with a high-fee child (CPFP).

The ledger that settles without permission also remembers without mercy, and Satoshi saw both privacy leaks coming in 2008. Section 10 of the whitepaper advises that a new key pair should be used for each payment — address reuse collapses your history into one publicly watchable cluster — and then concedes the harder problem: multi-input transactions "necessarily reveal that their inputs were owned by the same owner". That sentence is the common-input-ownership heuristic, and an entire chain-surveillance industry is built on it. Spend five UTXOs together and any observer may assume one entity owned all five, merging their histories — the coffee you bought, the exchange that identified you, the donation you thought was anonymous — into a single file with your name pencilled on it.

Which is why coin selection — the choice of which coins fund a payment — is a decision, not a detail. Every custodial user delegates it unknowingly; every self-custodial wallet makes it constantly; good wallets let you make it yourself. The trade-offs are real: consolidating many small UTXOs while fees sit at 1 sat/vB is cheap hygiene that would cost a fortune in a congested mempool, but every merge welds histories together under the heuristic above. Hoarding one giant coin broadcasts your whole balance to every counterparty. And the 600 unsolicited sats that appear at your address one day may be a dust attack, hoping you will sweep them and link your clusters — the correct response is to label them do-not-spend and move on.