Unspent transaction output

An unspent transaction output (UTXO) is a discrete unit of cryptocurrency value that remains after a transaction has been processed, representing funds that have not yet been spent and are available to be used as inputs in future transactions.^[1] This concept forms the core of the UTXO model, originally proposed in the Bitcoin whitepaper as part of a system to track unspent transaction values in a peer-to-peer electronic cash network without relying on centralized intermediaries.^[2] In the UTXO model, each cryptocurrency transaction consumes one or more existing UTXOs as inputs, verifies their validity through cryptographic signatures, and generates new UTXOs as outputs, with the net difference accounting for transaction fees and any change returned to the sender.^[1] The global collection of all valid UTXOs, known as the UTXO set, serves as the dynamic ledger state of the blockchain, enabling nodes to validate new transactions by checking only this set rather than scanning the entire transaction history.^[3] This approach ensures that each UTXO can be spent only once, preventing double-spending through consensus mechanisms like proof-of-work.^[2] The UTXO model offers several key advantages over account-based models used in blockchains like Ethereum, including enhanced privacy by obscuring direct links between sender balances and transaction histories, as funds are mixed from multiple UTXO sources without revealing total holdings.^[4] It also supports scalability through stateless transaction validation, allowing parallel processing of independent transactions since each can be verified against the UTXO set without interdependencies.^[4] Additionally, its simplicity in data structures facilitates efficient storage and querying for full nodes, contributing to the decentralization of networks like Bitcoin.^[5] However, the model presents challenges, such as the accumulation of small "dust" UTXOs from change outputs, which can bloat the UTXO set and increase storage demands on nodes over time.^[6] Effective UTXO management, including consolidation techniques in wallets, is essential to mitigate fees from handling fragmented outputs and to maintain network efficiency.^[7] The model has influenced other cryptocurrencies, such as Litecoin and Cardano's extended UTXO (eUTXO) variant, which adds support for smart contracts while preserving core benefits.^[8]

Fundamentals

Definition and Core Concepts

An unspent transaction output (UTXO) is the portion of a transaction output in a blockchain that has not yet been spent in a subsequent transaction, serving as a discrete unit representing a specific amount of cryptocurrency owned by a particular address.^[1] This model treats cryptocurrency as indivisible "coins" or outputs from prior transactions, each with an associated value and ownership conditions, rather than a running balance.^[2] The UTXO thus encapsulates the fundamental unit of account in such systems, ensuring that ownership is tracked through cryptographic references to previous outputs.^[9] The core purpose of the UTXO model is to enable stateless verification of transactions by allowing nodes to confirm validity solely through references to prior unspent outputs, thereby preventing double-spending while maintaining immutability and security in permissionless networks.^[1] By requiring new transactions to explicitly consume existing UTXOs as inputs, the model enforces that each unit of value can only be spent once, with verification relying on the cryptographic integrity of the referenced outputs rather than a global state ledger.^[2] This approach supports efficient, decentralized consensus, as full nodes maintain a set of all current UTXOs—the UTXO set—to validate incoming transactions without recomputing the entire transaction history.^[10] Key concepts in the UTXO model include the clear distinction between transaction inputs, which reference and spend existing UTXOs, and outputs, which create new UTXOs for recipients or change.^[1] Inputs effectively mark the referenced UTXOs as spent, removing them from availability, while outputs generate fresh UTXOs that become spendable once the transaction is confirmed in the blockchain.^[9] For intuitive understanding, the model is often analogized to physical cash: just as spending a bill consumes the original and issues new ones in change, UTXOs represent tangible units of value that are destroyed upon spending and recreated in new forms.^[1] A simple example illustrates this process: suppose an address holds a 1 BTC UTXO and initiates a transaction to send 0.5 BTC to another address; the input references the 1 BTC UTXO (marking it as spent), while the outputs create two new UTXOs—one of 0.5 BTC to the recipient and another of 0.5 BTC as change back to the sender (minus any fees).^[11] The original 1 BTC UTXO is now invalid, and the two 0.5 BTC outputs become the new unspent units available for future transactions.^[2]

Components of a UTXO

An unspent transaction output (UTXO) in Bitcoin is defined by a combination of identifiers and attributes that specify its origin, value, and spending conditions. The primary identifiers are the transaction ID (TXID) of the originating transaction and the output index (vout), which together form a unique reference known as an outpoint. The TXID is a 32-byte hash of the entire transaction, calculated by double-SHA256 hashing its serialized form in internal byte order, ensuring immutability once confirmed. The vout is a 4-byte unsigned integer (uint32_t) indicating the position of the output within the transaction's list of outputs, starting from 0. This pair (TXID + vout) allows any node to precisely locate and reference the UTXO across the blockchain without storing the full transaction data.^[12] The value component of a UTXO specifies the amount of bitcoin available for spending, measured in the smallest unit called satoshis (1 BTC = 100,000,000 satoshis). This is represented as an 8-byte signed integer (int64_t), with a minimum non-zero value of 1 satoshi, though zero-value outputs are permitted in certain cases like OP_RETURN for data storage. The value enforces conservation of funds during transactions, as the sum of output values cannot exceed the sum of input values (excluding coinbase transactions). This component directly determines the economic worth of the UTXO and is crucial for wallet balance calculations.^[12] The locking script, known as scriptPubKey, is the final core component, consisting of a variable-length byte sequence (up to 10,000 bytes, prefixed by a compactSize uint) that encodes the conditions under which the UTXO can be spent. It typically includes opcodes and data pushes, such as hashes of public keys or multisig requirements, to verify ownership. For instance, in a standard Pay-to-Public-Key-Hash (P2PKH) output, the scriptPubKey might be structured as: OP_DUP OP_HASH160 <20-byte pubkey hash> OP_EQUALVERIFY OP_CHECKSIG, which requires the spender to provide a signature matching the hashed public key. This script ensures security by requiring a corresponding unlocking script (scriptSig) in a spending transaction to evaluate successfully against it on the virtual machine.^[12] To illustrate, a sample Bitcoin UTXO could be referenced as follows: TXID abc123... (32 bytes), vout 0, amount 50000000 satoshis (0.5 BTC), and scriptPubKey 76a914<20-byte pubkey hash>88ac (in hexadecimal, equivalent to the P2PKH opcodes above). This breakdown highlights how the components interlink to form a spendable unit.^[12]

Historical Origins

Introduction in Bitcoin

The Unspent Transaction Output (UTXO) model was introduced in the Bitcoin whitepaper, titled "Bitcoin: A Peer-to-Peer Electronic Cash System," published on October 31, 2008, by the pseudonymous Satoshi Nakamoto, as a foundational solution to the double-spending problem in a decentralized electronic cash system without trusted third parties.^[2] The whitepaper proposes this model to enable direct peer-to-peer payments, where ownership of funds is tracked through verifiable chains of transactions rather than centralized ledgers.^[2] Nakamoto's design motivations centered on the UTXO model's simplicity for verifying transaction validity using only the set of unspent outputs, which avoids the need for global account balances and supports efficient operation in peer-to-peer networks.^[2] This approach allows nodes to confirm ownership and prevent double-spending by checking references to prior unspent outputs, promoting scalability through decentralized consensus without requiring all participants to maintain exhaustive historical data.^[2] In Section 2 of the whitepaper, transactions are explicitly described as chains of digital signatures, with each owner signing a hash of the previous transaction to transfer value, implicitly defining UTXOs as the discrete, spendable units that form the basis of this ownership model.^[2] Further emphasizing these motivations, Section 8 introduces Simplified Payment Verification (SPV), enabling lightweight nodes to validate payments by storing block headers and Merkle branches linked to specific UTXOs, thus allowing resource-constrained users to participate in the network without full blockchain storage.^[2] This UTXO-based verification contrasts with account-based models, which resemble centralized bank accounting by maintaining running balances.^[2] The UTXO model debuted in practice with Bitcoin's genesis block, mined by Nakamoto on January 3, 2009, at 18:15:05 UTC, where the coinbase transaction created the initial 50 BTC output as the first unspent transaction output in the system.^[13]

Adoption in Other Cryptocurrencies

The UTXO model quickly proliferated beyond Bitcoin through early forks that preserved its core transaction structure for simplicity and security. Litecoin, launched in October 2011 as a Bitcoin fork, retained the UTXO model to support faster block generation times of 2.5 minutes while inheriting Bitcoin's unspent output tracking for balance management.^[14] Similarly, Namecoin, released in April 2011, adopted the UTXO model to enable a decentralized domain name system (DNS) on its blockchain, allowing secure registration and transfer of .bit domains as key-value pairs within transactions.^[15] Peercoin, launched on August 19, 2012, was the first cryptocurrency to combine proof-of-work and proof-of-stake consensus mechanisms while utilizing the UTXO model for transaction validation and coin minting.^[16] Dash, originally released as XCoin on January 18, 2014, and rebranded later that year, employed the UTXO model and introduced masternodes to enable features like InstantSend for faster transactions and PrivateSend for enhanced privacy.^[17] Subsequent variants introduced targeted enhancements while maintaining the UTXO foundation. Bitcoin Cash, which forked from Bitcoin on August 1, 2017, at block height 478,558, preserved the UTXO model and Bitcoin Script but increased the block size limit to 8 MB (expanded to 32 MB in subsequent upgrades) to accommodate higher transaction throughput without altering output validation mechanics.^[18] Zcash, launched in October 2016, built directly on the UTXO model by incorporating zk-SNARKs for optional shielded transactions, enabling privacy for sender, receiver, and amount details through zero-knowledge proofs while supporting transparent UTXOs for compatibility.^[19] By 2025, the UTXO model has seen expanded adoption in layer-2 scaling solutions and specialized chains. The Lightning Network, a layer-2 protocol for Bitcoin, leverages UTXO-based bidirectional payment channels to conduct off-chain transactions at high speed and low cost, with channel openings and closures settling via on-chain UTXOs to enforce security.^[20] Ergo, mainnet-launched on July 1, 2021, employs an extended UTXO (eUTXO) model with advanced scripting capabilities to support smart contracts, decentralized finance applications, and non-fungible tokens while prioritizing security and scalability.^[21] Nervos Common Knowledge Base (CKB), mainnet-launched in November 2019, refines the UTXO model into its programmable Cell model, which treats cells as stateful UTXOs to facilitate smart contract execution, multi-asset support, and interoperability in a proof-of-work environment isomorphic to Bitcoin.^[22] The model's enduring influence stems from its strengths in privacy and scalability contexts, often contrasting with account-based alternatives. Privacy coins like Monero utilize a modified UTXO model with ring signatures, stealth addresses, and confidential transactions to obscure transaction graphs, promoting fungibility despite the computational overhead.^[23] This approach appeals to projects prioritizing unlinkability, unlike Ethereum's account-based model, which tracks persistent balances for seamless smart contract state management but faces challenges in parallel processing and inherent transparency.^[24] Cardano extends this lineage with its Extended UTXO (EUTXO) model, incorporating script-based validation for deterministic smart contracts.^[25]

Mechanics of Operation

Creating UTXOs

Unspent transaction outputs (UTXOs) are generated as the outputs of valid transactions within the Bitcoin network. Each transaction consumes existing UTXOs as inputs, which reference prior transaction identifiers (TXIDs) and output indices, while its outputs define new UTXOs by specifying satoshi amounts and locking scripts that determine spending conditions.^[1] These outputs become available as UTXOs once the transaction is confirmed in a block, enabling the transfer and division of value across the blockchain.^[26] A special mechanism for creating UTXOs occurs through coinbase transactions, which form the first transaction in every block and introduce new bitcoins into circulation without requiring inputs. These transactions reward miners with a block subsidy plus collected transaction fees, producing UTXOs locked to the miner's specified address.^[27] In Bitcoin's genesis block mined on January 3, 2009, the coinbase transaction created an initial subsidy of 50 BTC as a new UTXO.^[28] The subsidy halves every 210,000 blocks—approximately every four years—to enforce a predictable issuance schedule, with the current rate at 3.125 BTC as of block height 840,000 in April 2024.^[29] In regular transactions, new UTXOs are created by ensuring the total value of inputs equals the total value of outputs plus a transaction fee paid to miners. This conservation principle prevents value creation outside the coinbase mechanism, where fees are calculated as the difference between input and output sums.^[1] Outputs can direct funds to multiple recipients, allowing users to split UTXOs for payments or change; for instance, a transaction consuming a 1 BTC input might produce two 0.4 BTC outputs to separate addresses, with the 0.2 BTC difference serving as the fee.^[1]

Spending and Validation Process

To spend an unspent transaction output (UTXO), a new transaction references it as an input by specifying the transaction ID (TXID) of the previous transaction that created the UTXO and the output index (vout) identifying the specific output within that transaction.^[1] This input is paired with an unlocking script, known as the scriptSig, which provides the necessary data—such as a digital signature and public key—to satisfy the conditions set by the UTXO's locking script (pubkey script).^[1] Once spent, the UTXO is marked as consumed and removed from the global UTXO set, preventing reuse, while the new transaction creates fresh outputs that become new UTXOs available for future spending.^[1] The validation process for spending a UTXO occurs when a Bitcoin node receives a transaction and verifies its inputs against the current UTXO set. First, the node checks that the referenced UTXO exists, remains unspent, and matches the provided TXID and vout details.^[1] It then executes the unlocking script (scriptSig) concatenated with the locking script in a stack-based virtual machine, ensuring the combined script evaluates to true without errors.^[30] This execution confirms that the spender meets the predefined conditions, such as providing a valid signature; additionally, the node verifies that the transaction does not attempt a double-spend by cross-referencing against previously confirmed spends in the blockchain.^[2] If all checks pass, the transaction is accepted into the mempool and may be included in a block; transaction fees are implicitly calculated as the difference between total input value and total output value, rewarding miners for validation efforts.^[1] Bitcoin Script enables these validations through opcodes that enforce spending rules, with standard scripts like pay-to-public-key-hash (P2PKH) being the most common for UTXO spending.^[30] In a P2PKH locking script, the format is OP_DUP OP_HASH160 <PubKeyHash> OP_EQUALVERIFY OP_CHECKSIG, which requires the spender to prove control over the hashed public key via a signature.^[1] The OP_CHECKSIG opcode plays a central role by verifying that the provided signature corresponds to the public key and covers the relevant transaction data, ensuring authenticity and preventing unauthorized spends.^[30] For example, to spend a P2PKH UTXO, the scriptSig contains the signature followed by the full public key (e.g., <sig> <pubkey>), which the node processes as follows: the public key is duplicated and hashed to match the PubKeyHash from the locking script; if equal, OP_CHECKSIG validates the signature against the transaction hash, marking the UTXO as spent upon success and consuming it entirely.^[1] This process maintains the integrity of the UTXO model by linking ownership through cryptographic proofs, with the entire validation being deterministic and reproducible across the network.^[2]

Model Comparisons

UTXO Model vs. Account-Based Model

The UTXO model represents blockchain state through discrete, immutable transaction outputs that serve as unspent funds, each identifiable by a unique transaction ID and output index, functioning in a content-addressable manner.^[2] In contrast, the account-based model maintains state as mutable balances associated with accounts, each identified by a fixed address and augmented with a nonce to enforce transaction ordering and prevent replays.^[31] This fundamental divergence leads to UTXO treating cryptocurrency as individual, non-fungible units akin to cash notes, while the account model aggregates value in ledger-like entries similar to bank balances. In the UTXO model, transactions explicitly reference prior unspent outputs as inputs, which are consumed upon spending, and generate new outputs to distribute value, enabling splitting or combining without altering existing records.^[2] The account-based model, however, handles transactions by directly debiting the sender's balance and crediting the recipient's, akin to a centralized database update, without needing to reference specific prior units.^[31] This explicit input-output structure in UTXO ensures traceability of funds through chains of transactions, whereas account-based updates rely on global state modifications for simplicity. Verification in the UTXO model supports parallel, stateless processing, as each transaction can be validated independently by checking input references against the unspent set and signatures, without requiring the entire historical state.^[2] Conversely, the account-based model demands consistency with the full world state, often stored in a Merkle Patricia trie, to compute balances and execute updates sequentially, potentially introducing dependencies across transactions.^[31] Double-spend prevention in UTXO occurs by marking inputs as spent once referenced, leveraging the immutable nature of the output set, while in the account model, it is enforced by verifying that the sender's balance suffices before applying changes.

Aspect	UTXO Model	Account-Based Model
State Representation	Discrete, immutable outputs in a content-addressable set.^[2]	Mutable balances in accounts, tracked via a global trie structure.^[31]
Transaction Handling	Explicit consumption of inputs and creation of new outputs.^[2]	Direct balance adjustments without input references.^[31]
Verification	Parallel, stateless checks against unspent set.	Sequential execution requiring full state consistency.^[31]
Double-Spend Prevention	Marking specific outputs as spent upon use.^[2]	Balance sufficiency checks before updates.
Node Requirements	Pruneable UTXO set (e.g., ~11 GB as of mid-2025).^[32]	Full state trie (e.g., ~250 GB as of late 2025 and growing).^[33]

Key Advantages and Limitations

The UTXO model provides enhanced privacy compared to account-based systems because it does not maintain a persistent balance for addresses, making it more difficult to link multiple transactions to a single user by treating each output as an independent unit.^[34] This structure allows users to generate new addresses for each transaction, obscuring ownership trails without directly tracking account histories.^[2] For instance, mixing services like CoinJoin exploit this by combining multiple users' UTXOs into a single transaction, expanding the anonymity set and complicating forensic analysis of fund origins.^[35] In terms of scalability, the UTXO model supports parallel transaction processing since outputs are discrete and do not require global state updates, enabling lightweight nodes to verify transactions using only the UTXO set rather than the entire blockchain history.^[9] This reduces bandwidth and storage demands for non-full nodes, facilitating broader network participation.^[2] Security benefits arise from the immutability of spent outputs, which inherently prevents double-spending attacks by design, as each UTXO can only be consumed once in a valid transaction.^[2] However, the model faces limitations in data management, as the global UTXO set grows continuously with new unspent outputs—for example, reaching approximately 11 GB as of mid-2025—imposing higher storage requirements on full nodes and slowing initial block downloads.^[32] Handling change outputs introduces complexity, where returning excess funds to a new address can inadvertently leak privacy if wallet software reuses patterns or consolidates UTXOs inefficiently.^[9] The UTXO model's stateless nature also makes it less intuitive for complex smart contracts, as it lacks built-in support for maintaining ongoing state like balances in decentralized finance (DeFi) applications, often requiring workarounds that increase transaction overhead.^[36] In real-world impacts, the encouragement of address non-reuse in UTXO systems aids quantum resistance, as public keys remain unexposed for unspent outputs until spending occurs, mitigating risks from algorithms like Shor's that could derive private keys from revealed public keys.^[37] Conversely, DeFi implementations on UTXO chains struggle with state management, leading to higher complexity and potential inefficiencies in protocols requiring frequent interactions.^[36] However, Ethereum is exploring solutions like state expiry to mitigate state growth and enable stateless clients.^[33]

Advanced Variants

The Global UTXO Set

The global UTXO set represents the aggregated collection of all unspent transaction outputs across the Bitcoin blockchain, functioning as a dynamic database that tracks the current state of spendable bitcoins.^[38] This set is maintained by full nodes, which update it with every validated block by incorporating new transaction outputs while removing those spent as inputs, ensuring a real-time snapshot without requiring traversal of the entire blockchain history.^[3] For storage efficiency, Bitcoin Core implements the UTXO set using a key-value database such as LevelDB, often augmented with caching mechanisms to accelerate lookups during validation.^[39] As of mid-2025, the Bitcoin UTXO set comprises approximately 170 million entries, occupying around 11 GB of disk space under standard node configurations, reflecting steady growth driven by transaction volume and output creation.^[32] Full nodes manage this size through optional pruning of historical blockchain data, retaining only the UTXO set and recent blocks to minimize storage demands while preserving validation capabilities.^[40] In the consensus process, full nodes rely on the UTXO set to validate incoming transactions by confirming that referenced inputs exist, remain unspent, and meet spending conditions like script signatures.^[3] This enables efficient rule enforcement without reprocessing prior blocks, contributing to Bitcoin's scalability for verification. Simplified Payment Verification (SPV) clients, used in lightweight wallets, query full nodes for balance checks and use Merkle proofs to verify transaction inclusion in blocks, avoiding the need to store the full set locally.^[41] A key challenge for the UTXO set is the accumulation of dust UTXOs—outputs with values below the minimum viable transaction fee threshold, often resulting from change or spam transactions—which inflate set size and increase validation overhead without economic utility.^[42] For instance, such dust has contributed to recent expansions from under 5 GB to over 11 GB in the set's footprint.^[43] Users and nodes address this through consolidation transactions, which combine multiple small UTXOs into fewer larger ones during low-fee periods, thereby reducing bloat and future costs.^[44]

Extended UTXO (EUTXO) Model

The Extended UTXO (EUTXO) model was developed by Input Output Hong Kong (IOHK) researchers as an enhancement to the standard UTXO model, specifically for integration into the Cardano blockchain, which launched its mainnet in September 2017. The model enables support for sophisticated smart contracts by embedding state and logic directly into transaction outputs, a design formalized in a 2020 academic paper that outlines its use in Cardano's ledger and the Plutus smart contract platform. Plutus capabilities, which leverage EUTXO for on-chain contract execution, were activated through Cardano's Alonzo hard fork upgrade on September 12, 2021. This extension addresses limitations in Bitcoin's original UTXO by allowing outputs to carry not just value but also contract-specific data and validation rules, thereby facilitating deterministic state transitions without introducing a global shared state. In the EUTXO model, each unspent output is structured as a tuple consisting of a validator script ν, a value (such as cryptocurrency amounts), and a datum δ representing contract state, such as a counter or ownership details. To spend an input, a transaction must supply a redeemer ρ—arbitrary data like a proposed action—and the full transaction context tx, which the validator script evaluates via the function ν(value, δ, ρ, tx) to return true or false. This validation occurs on-chain but relies on off-chain computation to predict outcomes and fees deterministically, ensuring predictability in resource usage unlike Ethereum's account-based model, where execution happens fully on-chain and can vary due to network conditions. By passing the entire transaction to validators, EUTXO enforces continuity: new outputs must reference prior states correctly, preventing unauthorized changes while maintaining the parallelism of standard UTXO, as independent transactions do not interfere. Compared to the standard UTXO model, EUTXO introduces programmability for complex logic, such as state machines, without sacrificing concurrency or simplicity; for instance, a vending machine contract might lock value in a UTXO with a datum δ specifying inventory levels, where a buyer spends it by providing a redeemer ρ indicating the item selected, and the validator script checks payment sufficiency before creating a new output with updated inventory and change. This design supports applications like multi-signature escrow or crowdfunding, where state evolves through chained outputs rather than mutable accounts. The model's emphasis on local validation per output enhances security by isolating contract states, reducing risks from interconnected global changes. As of 2025, the EUTXO model remains central to Cardano's ecosystem, underpinning its decentralized applications and ongoing upgrades that enhance scalability and multi-asset support. It has influenced other projects, notably Ergo, a proof-of-work blockchain launched on July 1, 2019, which adopted EUTXO to enable advanced programmability while inheriting UTXO's security properties. Ergo's implementation extends the model with features like sigma protocols for efficient validation, demonstrating EUTXO's role in overcoming traditional UTXO constraints in smart contract environments.