<p>They are owned (or at least, controlled; ownership is more of a legal/social term than a technical one) <em>by the script</em>.</p>
<p>For simple scripts, which just require a signature by a single public key in one way or form, there is an easy correspondence between keys and scripts, and for those you can just as well say the coins are controlled by that key, or equivalently, by the person/entity who has access to its corresponding private key.</p>
<p>However, there is no requirement for scripts to correspond to just a single key, or even a multiple of keys. As your example shows, the script can reasonably not contain any keys at all.</p>
<p>Note that the example given is actually insecure. If someone were to find a viable SHA1 collision that could unlock the script, the coins can be stolen by miners. There is no signature, and thus nothing that prevents the reported collision from being used in any other transaction than the finders' one.</p>

CC BY-SA 4.0
2021-12-12T15:10:26.230Z
Can you check if my answer is correct please?
SickGuy
CC BY-SA 4.0
2021-12-12T15:05:05.900Z
2021-12-12T15:05:05.900Z
Pieter Wuille
<p>It seems my understanding that all bitcoins need to belong to some address was wrong:</p>
<blockquote>
<p>There are no accounts or balances in bitcoin; there are only unspent
transaction outputs (UTXO) scattered in the blockchain.</p>
</blockquote>
<p><a href="https://www.oreilly.com/library/view/mastering-bitcoin/9781491902639/ch05.html" rel="nofollow noreferrer">source.</a></p>
<p>So the answer is that the Unspent Transaction Outputs created by the transaction are indeed unspendable unless someone can unlock them.</p>
<p>And they do not &quot;belong&quot; to anyone as there are no accounts or balances in bitcoin.</p>

CC BY-SA 4.0
2021-12-12T15:23:33.233Z
You're right that they don't belong to "anyone", but this is unrelated to the fact that Bitcoin has no accounts or balances. One could imagine a hypothetical account/balance based system where scripts also control access to funds (there are good reasons not to do that, but it's certainly feasible).
Pieter Wuille
CC BY-SA 4.0
2021-12-12T15:02:00.467Z
2021-12-12T15:02:00.467Z
SickGuy
<p>I am currently learning about bitcoin transactions and I found out about the scriptPubKey which locks every output until it is spent by using the unlocking script.</p>
<p>My question is who owns the bitcoins before they are spent and unlocked?</p>
<p>For example, I came across a <a href="https://www.reddit.com/r/Bitcoin/comments/1mavh9/trustless_bitcoin_bounty_for_sha1_sha256_etc/" rel="nofollow noreferrer">reddit post</a> that mentions transaction outputs with a hash collision bounty as their locking script:
<code>OP_2DUP OP_EQUAL OP_NOT OP_VERIFY OP_SHA1 OP_SWAP OP_SHA1 OP_EQUAL</code></p>
<p>Am I right to deduce that unless someone finds a collisoin to the specified hash functions these bitcoins are just unspendable and thus belong to nobody?</p>

<transactions><script>
Who do locked bitcoins belong to?
SickGuy
# Who do locked bitcoins belong to?

(Asked by: username_0 on 2021-12-12)

I am currently learning about bitcoin transactions and I found out about the scriptPubKey which locks every output until it is spent by using the unlocking script.

My question is who owns the bitcoins before they are spent and unlocked?

For example, I came across a [reddit post](https://www.reddit.com/r/Bitcoin/comments/1mavh9/trustless_bitcoin_bounty_for_sha1_sha256_etc/) that mentions transaction outputs with a hash collision bounty as their locking script:
`OP_2DUP OP_EQUAL OP_NOT OP_VERIFY OP_SHA1 OP_SWAP OP_SHA1 OP_EQUAL`

Am I right to deduce that unless someone finds a collisoin to the specified hash functions these bitcoins are just unspendable and thus belong to nobody?

**Tags:** transactions, script


---

## 2 answers

### Answer by username_1 on 2021-12-12. Score: 2 | Accepted answer

They are owned (or at least, controlled; ownership is more of a legal/social term than a technical one) *by the script*.

For simple scripts, which just require a signature by a single public key in one way or form, there is an easy correspondence between keys and scripts, and for those you can just as well say the coins are controlled by that key, or equivalently, by the person/entity who has access to its corresponding private key.

However, there is no requirement for scripts to correspond to just a single key, or even a multiple of keys. As your example shows, the script can reasonably not contain any keys at all.

Note that the example given is actually insecure. If someone were to find a viable SHA1 collision that could unlock the script, the coins can be stolen by miners. There is no signature, and thus nothing that prevents the reported collision from being used in any other transaction than the finders' one.

> **Comments:**
> **username_0**: Can you check if my answer is correct please?  

---

### Answer by username_0 on 2021-12-12. Score: 0

It seems my understanding that all bitcoins need to belong to some address was wrong:

> There are no accounts or balances in bitcoin; there are only unspent
> transaction outputs (UTXO) scattered in the blockchain.

[source.](https://www.oreilly.com/library/view/mastering-bitcoin/9781491902639/ch05.html)

So the answer is that the Unspent Transaction Outputs created by the transaction are indeed unspendable unless someone can unlock them.

And they do not "belong" to anyone as there are no accounts or balances in bitcoin.

> **Comments:**
> **username_1**: You're right that they don't belong to "anyone", but this is unrelated to the fact that Bitcoin has no accounts or balances. One could imagine a hypothetical account/balance based system where scripts also control access to funds (there are good reasons not to do that, but it's certainly feasible).  

---

