The UTXO Model
What you'll learn on this page: why Bitcoin looks more like cash than a bank account, and why that choice is the foundation of every privacy analysis you will ever do.
Cash, not a bank account
When you look at your bank balance, you see one number. If you have Rs 10,000 and spend Rs 700, the bank subtracts 700 and you have 9,300. Simple.
Bitcoin does not work like that.
Bitcoin works like cash in your pocket. You do not have "a balance". You have a stack of individual notes, each with a fixed amount. When you pay, you hand over whole notes and you get change back.
Each "note" in Bitcoin is called an Unspent Transaction Output, or UTXO. That is the entire mental model.
A worked example
Imagine Alice has three UTXOs in her wallet.
- one worth 1.00 BTC
- one worth 0.50 BTC
- one worth 0.25 BTC
Alice wants to pay Bob 0.70 BTC. She cannot split the 1.00 BTC note in half and hand Bob a piece of it. She has to hand over the whole note and take change.
So she builds a transaction that does this:
The 1.00 BTC UTXO is now spent. It cannot be used again. In its place, two brand-new UTXOs exist: one owned by Bob, one owned by Alice. Alice's 0.50 and 0.25 UTXOs were not touched.
That is the UTXO model in one picture: old notes get destroyed, new notes get created, the total stays the same (minus the fee).
Why analysts care
Because every Bitcoin transaction is public, anyone can look at a transaction and see:
- which old UTXOs it consumed,
- which new UTXOs it created,
- which of the new UTXOs looks like payment, and which looks like change.
That last question is the whole game. If you can reliably tell change from payment, you can follow the sender's wallet forward through time. If you can tell which inputs were bundled together, you can infer that they probably belong to the same owner.
The UTXO model is what makes this possible. A pure account model would hide it.
What this model leaks
Four patterns come directly from how UTXOs work, and every heuristic in txray is built on top of them.
- Which coins were spent together. When one transaction spends several UTXOs, those UTXOs were almost certainly controlled by the same wallet.
- Which output is change. Wallets have tell-tale habits when building the change output (round payment amounts, matching script types, predictable position).
- Address reuse. If the same address appears in two unrelated transactions, those transactions link back to one person.
- Multi-input clustering. Repeating the first pattern across many transactions lets you group thousands of addresses into one "wallet cluster".
You will meet all four again in the heuristics pages.