Bitcoin's UTXO Model Explained: Coins, Change & the UTXO Set

Introduction

A Bitcoin wallet that shows 0.5 BTC holds no such number anywhere on the network. What exists are separate coins, and the network tracked 164.0M of them on 4 November 2026, down from a peak of 188.2M in December 2024. Every payment spends coins whole and returns the remainder as change, and that one rule shapes fees, privacy and the cost of running a node. This guide sets the unspent transaction output (UTXO) model against the account model, follows a payment from coin selection to change, and measures what recent blocks and the UTXO set show. It closes with the arithmetic of dust and consolidation.

What Is a UTXO, and How Does It Differ From an Account Balance?

Bitcoin stores no account balances. A wallet's balance is the sum of separate coins, formally unspent transaction outputs (UTXOs), and the network tracked 163,986,105 of them on 4 November 2026 (txoutset.info, 2026). That design is the reason Bitcoin payments produce change.

Coins, not balances

A UTXO is an amount of bitcoin locked by a script, usually a requirement to sign with one key. A transaction spends outputs, called inputs once referenced, and creates new outputs. An output stays in the set until a later transaction spends it, and it can be spent exactly once (Stanford EE374). Wallet software scans for the outputs a key can unlock and adds them up, so the balance is a derived figure that no node stores. The 163.99M outputs hold 20.11M BTC. Blockchair counts 59.9M addresses with a non-zero balance, about 2.7 coins per funded address (Blockchair, 2026). The wider mechanics of the ledger are in the beginner's guide to Bitcoin ↗.

How an account model works instead

Ethereum keeps a table of accounts ↗. Each entry holds a balance and a counter called a nonce, and a transaction is valid when the sender's balance covers the amount and the nonce is next in line (Stanford EE374). The nonce blocks replay: without it, a copied payment would execute twice. Sending 1 ETH subtracts from one entry and adds to another, so no change exists and no coin selection happens. The price is ordering. Transactions from one account must run in nonce sequence, while two Bitcoin transactions that spend different coins can be checked independently (ReadWhitepaper, 2024). Ethereum's state records the nonce beside the balance of every account, so that table grows with the number of accounts, not with the number of payments.

What each design buys and costs

UTXOs validate in isolation, which suits parallel checking and keeps scripts simple, but a payment usually creates two outputs and every output becomes state that every node stores (ReadWhitepaper, 2024). Accounts need less storage per user and suit contracts that track many balances, but they add nonce ordering and a shared state that contracts can change under one another. Neither design is private by default. A UTXO chain exposes which coins fund a payment, and an account chain exposes one running balance per address. The model also sets the wallet's job on Bitcoin: choose coins, and manage change.

Data current as of November 2026.

A UTXO payment shows its cost at once: the coin is spent whole.

How Does a Bitcoin Payment Spend Coins and Create Change?

A coin cannot be spent in part. A wallet that holds one 0.5 BTC coin and owes 0.1 BTC spends the whole coin, sends 0.1 BTC to the seller and returns the remainder to itself as a change output. That change output is a new coin, created in the same transaction as the payment.

Inputs are spent whole

Each input points to one earlier output by transaction ID and output number, and carries the signature or script data that unlocks it. The network removes every referenced output from the UTXO set once the transaction confirms. A coin has no partial state: a 0.5 BTC output either exists or has been consumed. A transaction can reference one input or hundreds, and a standard transaction may weigh up to 400,000 weight units, about 100,000 virtual bytes (vB), under Bitcoin Core's relay policy (Bitcoin Core, policy.h). Each input adds bytes the sender pays for, so the number of coins a wallet touches moves the fee more than the amount sent ↗. A payment of 0.001 BTC and one of 10 BTC weigh the same when each spends a single native SegWit coin.

The change output

The outputs of a transaction cannot exceed its inputs, and any difference goes to miners as the fee. A wallet therefore adds an output that pays the leftover back to an address it controls. Hierarchical-deterministic wallets ↗ derive that change address from the same seed phrase, so restoring the seed finds the change again. The change output is an ordinary UTXO with a fresh locking script, ready for the next payment. A wallet drops a leftover too small to deserve its own output and lets it go to the miner as extra fee. The protocol never marks it as change; the label lives in the wallet and in the guesses of outside analysts.

Fee and the whole payment in numbers

Take a native SegWit coin of 0.5 BTC and a payment of 0.1 BTC. The transaction has one input (68 vB), two outputs (31 vB each) and 10.5 vB of overhead, 141 vB in total (Blockstream, 2026). At the 1.03 sat/vB median fee rate of an eight-block sample taken for this article on 21 October 2026, the fee is about 145 sats, roughly $0.11 at a BTC price of $78,269 on 4 November 2026, which is 37.9% below the $126,173 high of 6 October 2025 (CoinPaprika API, 2026). The outputs are 0.1 BTC to the seller and 0.39999855 BTC back to the wallet.

Which coin a wallet picks decides whether that change output exists at all.

How Do Wallets Choose Which Coins to Spend?

Coin selection is the wallet's choice of which UTXOs to spend. The choice sets the fee, decides whether a change output exists and determines how many coins remain afterward. Bitcoin Core runs several algorithms and keeps the candidate with the lowest waste score (Bitcoin Core, coinselection.cpp).

Branch and Bound hunts for a changeless payment

Branch and Bound, designed by Mark Erhardt (known as Murch) for his 2016 thesis, searches for an input set that covers the payment without overshooting by more than the cost of creating and spending a change output. A match inside that window needs no change output, so the transaction is smaller and leaves no new coin behind. Core scores each candidate by waste: inputs times the gap between the current and the long-term fee rate, plus any excess (Bitcoin Core, coinselection.cpp). When fees sit above the long-term estimate, extra inputs add waste. When fees sit below it, spending more inputs scores better, because clearing coins is cheap.

CoinGrinder and the other fallbacks

CoinGrinder, added in 2024, finds the lowest-weight input set that still produces change. Core runs it only when fee rates are far above the long-term estimate, because minimizing inputs every time wears a wallet down to small coins (Bitcoin Core, PR 27877). In Erhardt's simulations, always minimizing inputs produced a pool with 15 times the coin count of Core's 2016 Knapsack method (Bitcoin Core, PR 27877). Knapsack, the older fallback, and Single Random Draw, which picks coins at random until the target is met, supply further candidates. Randomness makes a wallet's choices harder to predict from outside. The wallet compares all of them and keeps the lowest waste.

Why selection shapes the wallet over time

Selection acts over hundreds of payments. A wallet that always spends its largest coin leaves ever smaller change outputs. A wallet that always spends many small coins merges its history and pays more per payment. A changeless payment leaves the sender with one coin fewer. A wallet that rarely finds a changeless match pays twice for change: a native SegWit change output adds 31 vB now and costs 68 vB when it is spent, 99 vB in all (Blockstream, 2026). Owners who care about the shape of their holdings use coin control, a wallet feature that lets them tick which coins fund a payment, offered in Bitcoin Core's wallet, Sparrow and Electrum.

Data current as of November 2026.

Real blocks show how often wallets end up in each outcome.

What Do Real Transactions Look Like in a Recent Block Sample?

In a sample of 1,122 transactions without data outputs, 48.0% had one input and two outputs, the classic payment plus change. Another 28.0% had one input and one output. Consolidations with five or more inputs and one output made up 1.3%.

What the sample counted

The sample, taken on 21 October 2026, reads 2,125 transactions from blocks 972,338 to 972,345, drawn from evenly spaced pages that skip each block's first 25 transactions. It covers 3,581 inputs and 4,620 outputs (Blockstream Esplora API, 2026). Of the 2,125 transactions, 1,003 (47.2%) carry a zero-value OP_RETURN output, the data-carrying kind, and were set aside from the shape count to keep it on payments. The remaining 1,122 are the group counted. Output values use every output except the 1,007 OP_RETURN outputs themselves, which leaves 3,613 spendable outputs. The sample is a snapshot of one hour and skips the first transactions of each block, so the shares are indicative, not network-wide. Esplora returns the funding output for every input, which gives the script type and amount without running a node.

What the shapes mean

One-input, two-output transactions dominate, which fits a wallet paying one party and returning change. Single-output transactions (28.0%) are sweeps, or payments where one coin matched the amount. Many-input transactions are 11.2% with two outputs and 1.3% as consolidations of five or more coins into one; the largest transaction in the sample had 362 inputs. Fan-out shapes with three or more outputs add 6.9%, consistent with batched payouts. The median of the 3,613 spendable outputs held 94,372 sats, about $74 at the 4 November 2026 price of $78,269. The two-output shapes together cover 59.2% of the group, so most payments in the sample leave a change coin that the sender must spend again later.

Every one of those change outputs is also a clue for an outside observer.

How Do Change Outputs Weaken Bitcoin Privacy?

Spending several coins together tells an observer they share an owner, and a change output can point back to the sender. Chain analysts build wallet maps from those two signals. Privacy in the UTXO model is mostly a question of which coins a wallet combines.

Common input ownership

The co-spend rule treats all inputs of one transaction as controlled by one party, because one party had to sign for each of them (Chainalysis, 2026). Chainalysis calls it the foundation of Bitcoin address clustering. A consolidation with 362 inputs, like the largest in the sample, links all 362 funding addresses in one step. A cluster built this way can span years: one consolidation links every address that fed it, and later payments from the merged coin inherit the label. CoinJoin and PayJoin break the rule on purpose by letting several parties build one transaction together, and careful clustering tools try to exclude such transactions so they do not create false links.

Spotting the change output

Researchers have catalogued more than twenty change heuristics (Schnoering et al., 2024). Script type is the simplest. Among the sample's 539 one-input, two-output payments without data outputs, 33.6% paid to two different script types, so a wallet that spends native SegWit and pays a legacy address shows which output returns home. The other 66.4% used one type for both outputs and give no such hint. Round amounts help too: a round payment beside an odd remainder points to the remainder. A third test flags transactions that include an input the payment did not need, since wallets rarely add one. Single heuristics err, so tools combine them and weigh the results.

What reduces the leak

Fresh change addresses are the default in hierarchical-deterministic wallets, and they stop address reuse from linking payments. Coin control keeps coins from different sources in separate transactions. PayJoin lets the recipient add an input, which weakens the assumption that the sender owns every input. On-chain analytics platforms ↗ apply these heuristics at scale, so each tool in this list narrows a guess instead of closing it. Output amounts stay public in every case, and the timing and size of each payment remain visible even when the links break.

Data current as of November 2026.

The same coins, counted across the whole network, form the UTXO set.

How Big Is the UTXO Set, and Why Did It Double in 2023?

The UTXO set held 163,986,105 entries at block 974,511 on 4 November 2026. It crossed 100M in May 2023, peaked at 188.2M in December 2024 and has shed about 24.2M since (txoutset.info; bitcoinstats.io, 2026). Inscription-related outputs explain much of the climb.

The count today

Bitcoin Core reports the set with the gettxoutsetinfo command: 163,986,105 outputs holding 20,107,619.87 BTC at block 974,511 (txoutset.info, 2026). bitcoinstats.io, which tracks per-block changes, reads 163,987,427 at block 974,512; on 21 October 2026 it put the chainstate at 12.45 GB. Dividing the BTC in the set by the count gives 0.12 BTC per output, about $9,600 at $78,269, an average pulled up by a small number of large coins. blockchain.com's sampled chart shows 166.1M on 13 October 2026. The sources agree within about 1%, and the gap reflects timing and method. OP_RETURN outputs are provably unspendable and never enter the set (bitcoinstats.io, 2026).

The 2023 surge and inscription outputs

The set held 83.48M entries on 1 January 2023 and 153.27M a year later. The 69.8M net gain was the largest annual rise in the set's history from 2009 to October 2026 (bitcoinstats.io, 2026). mempool.space Research counted 173.2M UTXOs in May 2025, of which 29.6% (51.2M) were inscription-related. Together they held 415 BTC, a mean of 811 sats each, and 49.1% of all outputs held under 1,000 sats (mempool.space Research, 2025). Ordinals attach data to individual satoshis ↗ through Taproot witness space, and 72.9% of the inscription-related outputs were Taproot. Runes, a token protocol ↗, store balances in UTXOs. Both create many tiny coins that remain spendable but rarely worth moving.

The 2025 consolidation

2025 was the largest annual shrink from 2009 to October 2026: the set fell from 186.40M to 165.72M, a net loss of 20.7M (bitcoinstats.io, 2026). It has been roughly flat in 2026, down 1.7M to 164.0M by 4 November. A falling count means more outputs were spent than created. Fee rates near 1 sat/vB make merging small coins cheap, and the median in this article's sample was 1.03 sat/vB. The data show the fall, not its cause. The shrink does not undo the 2023 jump: today's count is still 96% above the 83.5M of January 2023.

Every node carries that set, so its size sets the price of running one.

What Does a Large UTXO Set Cost Node Operators?

Every full node keeps the UTXO set in a database and checks each new transaction against it. The set took 12.45 GB of disk on 21 October 2026, with only a slice held in memory (bitcoinstats.io, 2026). Size matters most at first start-up.

Disk and cache

Bitcoin Core stores the set in its chainstate directory, a LevelDB database, and caches part of it in memory under the dbcache setting, 450 MiB by default (mempool.space Research, 2025). Each entry stores the creation height, a coinbase flag, the amount and the locking script (Spark, 2026), so a tiny coin takes the same database space as a large one. The whole set does not sit in memory. A larger set slows the initial block download (IBD), the first full sync, on machines with little memory or slow disks, such as a Raspberry Pi. Pruned nodes discard old blocks but keep the entire set, because they need it to validate new transactions.

Faster starts and designs still on the table

The assumeutxo feature lets a new node load a snapshot of the set and reach the chain tip in minutes while the full history validates in the background (Bitcoin Core, 2026). Core added a mainnet snapshot at block 880,000 in March 2025; it held 184,821,030 coins in a 282 MB file (Bitcoin Core, PR 31969). Utreexo, which replaces the stored set with cryptographic proofs, runs in separate node software such as Utreexod and Floresta (Delving Bitcoin, 2026). A SwiftSync pull request for Bitcoin Core was closed without merging on 31 May 2026 (Bitcoin Core, PR 34004).

The cost of holding tiny coins is also paid by their owners.

What Is Dust, and When Does Consolidating UTXOs Pay Off?

Dust is an output worth less than it costs to spend. Bitcoin Core's relay policy draws the line at 546 sats for legacy outputs, 294 for native SegWit and 330 for Taproot. Whether a coin is worth spending depends on the fee rate on the day it moves.

Dust thresholds are policy

The thresholds follow from a default relay rate of 3,000 sat/kvB, or 3 sat/vB: an output is dust when its value is below the cost of spending it at that rate (Bitcoin Core, policy.cpp). Nodes refuse to relay transactions that create dust outputs, but consensus rules do not forbid them, so a miner can confirm them. Bitcoin Core's wallet folds a leftover below the dust level into the fee instead of creating a change output (Bitcoin Core, coinselection.cpp). The rate sits above the 1 to 2 sat/vB that mempool.space recommended on 4 November 2026, which makes many policy-dust coins cheap to spend today. In the sample, 4.4% of new spendable outputs were under 546 sats and 8.0% under 1,000 sats.

What spending costs at each fee rate

A native SegWit input weighs 68 vB, so spending it costs 68 sats at 1 sat/vB, 680 sats at 10 and 6,800 sats at 100 (Blockstream, 2026). Taproot key-path spends ↗ weigh 57.5 vB, which lowers every one of these costs by about 15%. The same arithmetic ranks the sample's new outputs. At 1 or 2 sat/vB none cost more to spend than they hold. At 10 sat/vB, 6.7% do; at 50 sat/vB, 10.2%; at 100 sat/vB, 12.0%. A coin worth less than its own spend cost is economically unspendable until fees fall, and it stays in the set until then.

Consolidate when fees are low

Consolidation merges many coins into one. Ten native SegWit inputs merged into one output weigh 721.5 vB, which costs 722 sats at 1 sat/vB and 72,150 sats, about $56 at $78,269, at 100 sat/vB. Paying early at a low rate avoids paying the per-input cost later at a higher one. The privacy cost is permanent, because the co-spend rule links every merged coin. Consolidating within one source of funds adds little new exposure; merging coins from separate sources links them.

Data current as of November 2026.

Fee rates decide which coins are worth moving, and time decides how long they have been waiting.

What Does the Age of a Coin Tell You?

Coin age is the time since an output was created, and Bitcoin Core stores the creation height with every UTXO. In a sample of 320 spent inputs, the median coin was 64 blocks old, roughly 11 hours at ten minutes a block. Of the sample, 55.3% were under a day old and 0.9% older than a year.

Age is a property of each UTXO

The chainstate keeps four fields per output: creation height, coinbase flag, amount and locking script (Spark, 2026). Age is the tip height minus the creation height, so every coin carries its own clock. The sample, taken on 21 October 2026, drew 320 inputs from random pages of blocks 972,338 to 972,345 and looked up each funding transaction (Blockstream Esplora API, 2026). 23.4% were spent in the very block that created them, 92.2% within a week, and the oldest was 1.5 years old. Spending is dominated by recent coins, and with 320 inputs each share carries a margin of about 5 percentage points. The sample spans a few hours of blocks, so a different week will shift the shares.

Coin days destroyed and the limits of age

Coin days destroyed multiply the amount of each spent output by its age in days. A 1 BTC coin that sat for 1,000 days adds 1,000 coin days when it moves. Blockchair recorded 13,687,776 coin days destroyed in the 24 hours to 4 November 2026 (Blockchair, 2026). Age has a blind spot: a holder who shuffles coins between own wallets resets the clock, and the new output looks young. Several of the on-chain metrics ↗ that analysts publish build on age for that reason, and read it as a signal, not as proof.

FAQ

?How can a wallet user see which UTXOs make up the balance?

Wallets with coin control list every coin with its amount, address and confirmations. Bitcoin Core's wallet, Sparrow and Electrum offer this view, and the listunspent command in Bitcoin Core prints the same data. The list also shows how many small coins sit in the wallet, which matters when fees rise and each extra input costs more.

?Is a UTXO the same thing as an address?

No. An address is a way to write down the script that locks an output, and one address can hold many UTXOs. A wallet also derives many addresses from one seed phrase. Blockchair counted 59.9M funded addresses against 164.0M UTXOs on 4 November 2026, about 2.7 coins per funded address.

?Is the UTXO set the same as the blockchain or the mempool?

No. The blockchain is the full history of blocks, the UTXO set is the current state derived from it, and the mempool holds unconfirmed transactions waiting for a block. A node checks each new transaction against the set, which took 12.45 GB on 21 October 2026, far less than the history. An output created by an unconfirmed transaction joins the set only once that transaction confirms.

?Which other cryptocurrencies use the UTXO model?

Litecoin and Bitcoin Cash, which share Bitcoin's design lineage, keep the model, and Cardano uses an extended version in which outputs can carry data. Ethereum and Solana use accounts instead. The choice sets how a wallet works: UTXO chains need coin selection and change, account chains do not.

?How many inputs can one transaction hold?

Consensus sets no count; block weight is the limit. Bitcoin Core's relay policy caps a standard transaction at 400,000 weight units, about 100,000 vB, which fits roughly 1,400 native SegWit inputs at 68 vB each. The largest transaction in this article's sample had 362 inputs.

?Why are OP_RETURN outputs not part of the UTXO set?

OP_RETURN outputs are provably unspendable, so nodes have no reason to track them, and Bitcoin Core never stores them in the chainstate. They still occupy block space: 47.2% of the sampled transactions carried one. They add to the size of the blockchain but not to the size of the set.

?Can a tiny unsolicited output be used to track a wallet?

Yes. In a dusting attack, someone sends tiny outputs to many addresses and waits for an owner to spend one together with other coins. The co-spend rule then links those addresses to one owner. A wallet with coin control can mark the dust coin as do-not-spend, and leaving it untouched breaks the link.

?What happens to the change if the wallet is restored from a seed phrase?

Change addresses derive from the same seed as receiving addresses, so a restore scan finds both and rebuilds the coin list from the chain. Labels and coin-control freezes that live only in the wallet file are not in the seed, so export them separately if they matter.

References / Sources