How to Read a Bitcoin Transaction (For Investigators)

To the untrained eye, a block explorer looks like an incomprehensible wall of alphanumeric garbage. However, reading a Bitcoin transaction is fundamental to any crypto investigation. You do not need to be a cryptographer to understand it; you only need to understand the mechanics of the UTXO model.

The UTXO Model (Unspent Transaction Outputs)

Think of Bitcoin not as a bank account with a balance, but as a wallet full of specific physical coins and bills. If you have a $20 bill and need to pay $5, you hand over the $20 (the input), and you receive a $5 receipt and a $15 bill back (the outputs).

Bitcoin works exactly the same way.

Inputs (Where the money comes from)

• •Inputs are previously received chunks of Bitcoin that the sender is now spending.
• •A transaction can have one input or hundreds. If you received ten payments of 0.1 BTC and want to send 1 BTC, your transaction will combine all ten inputs.
• •Every input must be fully spent in a transaction. You cannot spend half of a UTXO.

Outputs (Where the money goes)

Outputs are the destinations. In a standard payment transaction, there are usually two outputs:

1. The Payment: The amount going to the actual recipient.

2. The Change Address: The leftover Bitcoin returning to the sender. This is crucial for investigators. The change address belongs to the suspect, and linking change addresses is how investigators cluster anonymous wallets into singular entities.

Fees

The network fee is never explicitly listed as an output. It is the mathematical difference between the total inputs and total outputs (Inputs - Outputs = Fee).

Miners collect this discrepancy as their reward for processing the transaction.

Confirmations

A transaction with 0 confirmations is pending in the mempool and can theoretically be reversed or replaced. Once it has 1 confirmation, it is written to the blockchain. Standard investigative practice considers 6 confirmations completely irreversible.