How bitcoin works

Transactions: coins are not what you think

There are no coins in bitcoin. There are not even account balances. What the ledger actually records is a long list of outputs: chunks of value, each locked so that only the holder of a particular key can spend it. Your “balance” is just the sum of the outputs your keys can unlock. Each one is called a UTXO, an unspent transaction output.

A transaction consumes some existing outputs and creates new ones. Think of paying with banknotes. If you owe 30 and hold a 50, you hand over the whole 50 and get 20 back. Bitcoin works the same way: the 50 is destroyed and two new outputs appear, 30 locked to the shop and 20 locked back to you as change. Whatever is left over, usually a small amount, is the fee, and it goes to the miner who includes the transaction in a block.

1. Your wallet builds the transaction. It picks outputs you own as inputs, and writes new outputs for the recipient and for your change.
2. It signs. Your private key produces a signature proving you are entitled to spend each input. The key itself never leaves the device.
3. It broadcasts. The transaction passes from node to node across the world in a couple of seconds. Each node checks the signatures and confirms the inputs have not already been spent.
4. It waits. The transaction sits in each node’s mempool with thousands of others.
5. A miner confirms it. When a block containing it is mined, it has one confirmation. Every later block adds another, and makes it harder to undo.

Keys, addresses and seed phrases

Ownership in bitcoin rests on a pair of numbers. The private key is a secret, 256 bits long, chosen at random. From it, one-way mathematics on an elliptic curve produces a public key. Going forward is instant. Going backward, from public key to private key, is beyond every computer that exists.

An address is a short, typo-resistant encoding of a public key or of its hash. It is what you hand to someone who wants to pay you. Over the years the format has changed as the system was upgraded:

Nobody writes down a raw private key any more. Since 2013 wallets have used a seed phrase: 12 or 24 words from a standard list of 2,048, which encode one master secret. From that seed the wallet derives an endless tree of keys and addresses, so one backup covers everything, forever.

Inside a block and a transaction

The best way to see how the pieces fit is to open real ones. Below are the very first block, mined by Satoshi on 3 January 2009, and the first payment from one person to another, nine days later. Click any field.

Blocks and proof of work

Roughly every ten minutes, the pending transactions are gathered into a block. Each block’s header contains the hash of the block before it. That is the chain: alter any old block and its hash changes, which breaks the link stored in the next block, and the next, all the way to the present.

But a chain of hashes alone is cheap to forge. A cheat could alter an old block and simply recompute every hash after it in a fraction of a second. So bitcoin adds a cost. A block is only valid if its hash, read as a number, is below a certain target. Hash functions are unpredictable, so the only way to find such a hash is to try, change a number in the header called the nonce, and try again. Trillions upon trillions of times.

This is proof of work. It is deliberately wasteful in the way a bank vault door is deliberately heavy. Finding a valid block is enormously expensive. Checking one takes a single hash. And to rewrite a block buried under six others, an attacker would have to redo the work for all seven and still outrun everyone else adding new blocks on top.

Difficulty: the self-tuning clock

If more miners join, blocks would be found faster. If miners leave, slower. Bitcoin corrects for this without anyone deciding anything. Every 2,016 blocks, about two weeks, each node looks at how long those blocks actually took. If they came faster than ten minutes each, the target is lowered and mining gets harder. If slower, easier.

This difficulty adjustment is arguably the cleverest part of the design. It is why the supply schedule holds whether there are ten miners or ten million, and why mining stays competitive at any price. Its sternest test came in mid-2021, when China outlawed mining and about half the network’s computing power went dark within weeks. Blocks slowed. The difficulty fell by a record 28 percent in a single step. The ten-minute rhythm returned, and within six months the hashrate had fully recovered in other countries.

The reward for finding a block is cut in half every 210,000 blocks. That schedule, and what it does to supply, has its own chart on the economics page. The industry that grew up around the race is covered in mining.

Nodes: where the rules live

Miners get the attention, but nodes hold the power. A full node is any computer running bitcoin software that keeps a complete copy of the chain and checks every block against the rules: no coins created from nothing, no spending without a valid signature, no block over the size limit. A block that breaks a rule is ignored, however much work went into it.

This is why miners cannot simply vote themselves a bigger reward. They could produce such a block, but no node would accept it, no exchange would credit it and the electricity would be wasted. In the 2017 scaling dispute, most large miners and many companies wanted bigger blocks. Enough ordinary node operators refused that the plan was abandoned.

Running a node needs a modest computer, a few hundred gigabytes of disk and an internet connection. Most people who run one use Bitcoin Core, the direct descendant of Satoshi’s original program. A minority, estimated at somewhere between a tenth and a fifth of reachable nodes in 2026, run Bitcoin Knots, a variant with stricter filters.

The mempool and fees

Between being broadcast and being mined, a transaction waits in the mempool, short for memory pool. There is not one mempool but one per node, though they mostly agree. Block space is scarce, about four million “weight units” per block, so miners fill each block with the transactions that pay the most per unit of space.

The result is a continuous auction. The price is quoted in satoshis per virtual byte. When the network is quiet, one or two sats per vByte gets you into the next block. During frenzies, such as the Ordinals rush of 2023 or the hour of the 2024 halving, the going rate has spiked into the hundreds. Fees depend on a transaction’s size in bytes, not on the amount of money it moves.

Two tools help when a payment gets stuck. Replace-by-fee lets the sender rebroadcast with a higher fee. Child-pays-for-parent lets the recipient spend the unconfirmed coins in a new, generously priced transaction, so a miner must take both to collect.

How bitcoin changes: SegWit and Taproot

Bitcoin can be upgraded in two ways. A soft fork tightens the rules. Old software still accepts the new blocks, so the network stays together even if not everyone upgrades at once. A hard fork loosens them. Old software rejects the new blocks, and unless everyone moves together the chain splits in two. Bitcoin’s culture strongly prefers soft forks, and rare ones.

Segregated Witness, 2017

SegWit moved signatures out of the main body of a transaction into a separate “witness” section. That fixed a long-standing flaw called transaction malleability, which had made payment channels unsafe, and it changed how block size is measured so that blocks could carry roughly twice as many typical transactions. It activated in August 2017 after two years of bitter argument, and it is the foundation the Lightning Network is built on.

Taproot, 2021

Taproot introduced Schnorr signatures, which are smaller and can be combined, so that a transaction approved by many parties can look identical on-chain to one approved by a single person. It also lets a coin carry several alternative spending conditions while revealing only the one that is used. It activated in November 2021 with broad support and no drama. It remains the most recent change to bitcoin’s consensus rules, the longest such quiet period in the system’s history.

Current debates, as of October 2026

For a system that prizes stability, bitcoin had an unusually noisy year. Four arguments are worth understanding. None is settled.

What is block space for? Core 30 and Knots

Since 2023, people have used bitcoin transactions to store images, tokens and other data that has nothing to do with payments. One camp sees paying customers using the system as designed. Another sees spam that bloats every node’s disk. The fight came to a head over OP_RETURN, an instruction that lets a transaction carry a little arbitrary data. For years node software refused by default to relay more than 80 bytes of it. Bitcoin Core version 30, released on 10 October 2025, raised that default to 100,000 bytes, on the reasoning that the old limit was easily bypassed and pushed data into more harmful places. Opponents moved to Bitcoin Knots, which keeps tighter filters. These are relay policies, not consensus rules: they affect what a node will pass along, not what is valid in a block.

BIP-110: the fork that failed

Some opponents went further and proposed changing the consensus rules themselves. BIP-110 would have capped data-carrying parts of transactions for a trial year, by soft fork. It asked miners to signal support and, failing that, instructed its supporters’ nodes to reject non-signalling blocks from a set date: a “user-activated” fork. Michael Saylor, Adam Back and Jameson Lopp were among those who argued publicly against it. In the final voluntary period, 51 of 2,016 blocks signalled, all from one pool. When the mandatory window opened on 8 August 2026 at block 961,632, the first block ignored the rule. A breakaway chain following BIP-110 produced two blocks and went silent. No user funds were reported lost on the main chain.

Covenants: should coins carry instructions?

Today a bitcoin output can say who may spend it. A covenant would also let it restrict where it can be sent next. That one ability would enable vaults that give you time to cancel a theft, shared outputs that let many users split one on-chain coin, and more capable second layers. The two best-known proposals are OP_CHECKTEMPLATEVERIFY (BIP 119), for which an activation client with a signalling period running into 2027 was published in March 2026, and OP_CAT (BIP 347), whose specification was marked complete in March 2026 but which has no activation plan. Neither has broad consensus. Sceptics worry about unforeseen uses and about setting a precedent for frequent change.

Quantum resistance: BIP-360 and BIP-361

Bitcoin’s signatures rely on a mathematical problem that a sufficiently large quantum computer could solve. No such machine exists. But on 31 March 2026, Google researchers published estimates that breaking bitcoin’s curve would need fewer than 500,000 physical qubits, roughly a twentieth of earlier figures, and Google has set itself a 2029 deadline to move its own systems to quantum-safe cryptography.

BIP-360, by Hunter Beast, Ethan Heilman and Isabel Foxen Duke, proposes a new output type called pay-to-Merkle-root. It works like Taproot with the vulnerable shortcut removed, and is designed as a base to which quantum-safe signature schemes can later be added. It was published in its current form in February 2026 and remains a draft. BIP-361, co-authored by Jameson Lopp, is the controversial companion: a phased plan that would eventually stop the network accepting old-style signatures at all, which would freeze coins whose owners never migrate, including, presumably, Satoshi’s. Supporters call that a defence against a quantum thief seizing millions of dormant coins. Opponents call it confiscation. More on the underlying risk is on the risks page.

A footnote: eCash

Separately, developer Paul Sztorc launched a hard-fork copy of bitcoin called eCash in 2026 to enable “drivechains”, a sidechain design he had failed to get adopted. A test phase began in August and its main launch was scheduled for around the end of October 2026. Like the many bitcoin forks before it, it is a separate network with a separate coin and does not change bitcoin itself.