An unspent transaction output (UTXO) is a discrete unit of cryptocurrency received in a prior transaction but not yet used as input in a subsequent one. UTXOs form the foundational accounting mechanism of Bitcoin and many other blockchain-based protocols. Instead of tracking a single account balance, these networks represent ownership as a collection of individual unspent outputs belonging to a given address. The total value of all UTXOs linked to a wallet makes up the wallet's spendable balance.
The conceptual groundwork for the UTXO model traces back to Hal Finney's Reusable Proofs of Work proposal, which drew on Adam Back's 1997 Hashcash design. When Satoshi Nakamoto launched Bitcoin in 2009, it became the first widely deployed digital currency system to implement the model at scale. The design aimed to replicate the properties of physical cash in a digital environment, where discrete units of value change hands instead of account balances being incrementally adjusted.
Every transaction on a UTXO-based blockchain has two components: inputs and outputs. Inputs reference one or more previously created UTXOs, consuming them. Outputs specify recipient addresses and amounts sent. Any value not sent to an external recipient is returned to the sender as a new UTXO, acting as change. Once confirmed, input UTXOs are marked spent and removed from circulation, while new output UTXOs enter the pool of spendable funds.
A practical analogy clarifies the mechanic. If a person holds a UTXO worth 1 BTC and wants to send 0.3 BTC to another user, the entire 1 BTC UTXO is consumed as input. The transaction creates two outputs: 0.3 BTC to the recipient and about 0.7 BTC (minus any miner fee) returned to the sender as a new UTXO. The original UTXO ceases to exist, replaced by two new ones.
Importantly, UTXOs cannot be divided mid-transaction like physical currency. The entire output must be consumed, and any remainder is returned as change. Bitcoin denominations are not fixed; any value down to one satoshi (0.00000001 BTC) can form a UTXO.
Each UTXO carries a locking script binding the output to a specific recipient, usually encoded as the recipient's public key or its hash. To spend a UTXO, the owner must provide an unlocking script that meets the locking script's conditions, typically a valid digital signature from the corresponding private key. Without a valid signature, the network rejects the spending transaction. This ensures only the rightful owner can authorize fund movement.
The complete collection of all unspent outputs on the blockchain at any moment is called the UTXO set. Every full node maintains a local copy to validate incoming transactions. When a node receives a new transaction, it checks if each input matches an entry in the UTXO set. If any input references an already-spent output, the transaction is rejected.
The UTXO set is stored in a dedicated database directory on each node, called the chainstate. When a new block is confirmed, the chainstate updates: spent inputs are removed and new outputs added. Since every node holds an identical copy, the network reaches consensus on transaction validity without a central authority.
The UTXO set also represents the total circulating supply of a cryptocurrency at a given moment, since every existing coin must exist as an unspent output somewhere in the set.
Blockchain networks use two primary accounting approaches. The UTXO model, used by Bitcoin, Litecoin, Cardano, and Dogecoin, tracks value as discrete transferable objects. The account-based model, used by Ethereum, Tezos, and EOS, maintains a running balance for each address updated directly with each transaction.
In the account model, sending a payment deducts from one balance and credits another, like a traditional bank transfer. The UTXO model works like passing physical cash: individual units move from one holder to the next, and no single stored figure represents the total.
Each approach has trade-offs. The account model allows faster balance lookups since no historical scanning is needed but adds complexity in transaction ordering and state management. The UTXO model requires aggregating outputs to find a balance but its stateless, discrete nature enables simpler verification and clearer security reasoning.
A central challenge in digital payments is preventing funds from being spent more than once. The UTXO model solves this by making each output consumable only once. If a user broadcasts two transactions referencing the same UTXO, both enter the mempool, a staging area for unconfirmed transactions. Due to timestamping and ordering from Bitcoin's proof-of-work consensus, only one conflicting transaction is included in the chain. Later blocks mark the second as invalid since the UTXO is already spent.
The immutability of UTXOs also strengthens security at the data level. An output either exists in a fixed state or does not exist at all. There is no partial state to verify or reconcile, reducing the risk of errors and attacks that can affect balance-based systems during concurrent transaction processing.
Because each UTXO is independent, transactions referencing different inputs can be validated simultaneously. This enables parallel processing, allowing nodes to verify multiple transactions at once without waiting for sequential state updates. In high-throughput environments, this improves block validation efficiency.
Transaction fees in the UTXO model depend on transaction size in bytes, not the value transferred. Consolidating many small UTXOs into one output requires more data and higher fees. This incentivizes users to consolidate fragmented UTXOs during low network congestion, called UTXO management. Wallets with many small outputs, called "dust" when their value is less than the fees to spend them, can face high costs when moving funds.
The UTXO model offers modest privacy advantages over account-based systems. Each transaction can use multiple input addresses and send outputs to multiple recipients, complicating chain analysis. Wallets can generate new receiving addresses for each transaction, making it harder to link payments to one individual. While not fully anonymous, these features increase the effort needed to trace transactions compared to systems with all activity on a single named account.
Several blockchain projects have built upon or modified the core UTXO design. Cardano introduced the Extended UTXO (EUTXO) model, which augments standard UTXOs with the ability to carry arbitrary data and execute smart contract logic. This extension brings programmability to the UTXO paradigm while preserving many of its security and predictability properties.
In 2023, the Ordinals Protocol introduced a method for inscribing data onto individual satoshis within Bitcoin UTXOs. By assigning an ordinal number to each satoshi and attaching metadata to it, developers enabled the creation of Bitcoin-native digital artifacts. This gave rise to new token standards on Bitcoin, including BRC-20 fungible tokens and Runes, expanding the scope of what the UTXO model can represent beyond simple value transfer.
.webp)