<p>It is always up to the wallet client to decide which UTXOs are to be spent.  The protocol certainly doesn't require all UTXOs of an address to be spent at the same time.  A particular wallet client could be coded to do that, but I don't know of any that are.</p>

<p><a href="https://testnet.blockexplorer.com/address/moooopfhBjQDSJQuCj4aVr6s4b5pFbQin4" rel="nofollow noreferrer">Here</a> you can see a testnet example.  Transaction <code>90d042b...</code> spent only 2 of the 9 UTXOs available in address <code>moooopfhBjQDSJQuCj4aVr6s4b5pFbQin4</code>.  This transaction was created with just the ordinary <code>sendtoaddress</code> command in Bitcoin Core, no special options.</p>

<p>This isn't a significant security risk.  In a secure digital signature protocol, it should be infeasible to generate a valid signature without access to the private key, even if the public key is known.  That's what "public" means!  As far as we know, ECDSA is secure, so revealing the public key doesn't harm security.</p>

<p>Some people believe in planning for the possibility that an attack might someday be found on ECDSA.  If so, then there would be some advantage in not having revealed your public key.  After a new signing algorithm is incorporated into Bitcoin, you could create a transaction sending your coins to an address which uses the new algorithm.  This would reveal your public key and attackers could get started, but assuming the attack is fairly computationally intensive, you hope your transaction would be confirmed before an attacker could successfully create a forged signature on a transaction that would send your coins to him.</p>

<p>The tradeoff of this approach is that, as you note, as soon as you want to spend any coins from an address, you have to spend all the UTXOs.  This increases the size of the transaction and thus costs you more in fees.  That's why most clients don't do it; the security improvement is theoretical at best, but the costs are real.</p>

CC BY-SA 3.0
2016-11-19T17:41:33.160Z
Thanks, it is clear now. One small question: In the link you provided to a testnet transaction, how can you see the 9 UTXOs available to the address? I could find the 2 you mentioned in the transaction but not the 9 available.
Gradient
CC BY-SA 3.0
2016-11-19T17:46:22.727Z
@Gradient: Keep scrolling down.
Nate Eldredge
CC BY-SA 3.0
2016-11-19T18:05:59.957Z
I don't see what you mean. I only see the transactions on the page you linked.
Gradient
CC BY-SA 3.0
2016-11-19T18:29:02.833Z
@Gradient: There are a total of 10 transactions shown on that page, in reverse chronological order.  The most recent one is 90d0.  At the time of that transaction, the other 9 were already available and unspent: 932c, 1f19, fdba, f643, 7142, 53f9, 9579, b5a9, ba6d.  90d0 only spent 932c and b5a9 (expand 90d0 and click the arrows to get the transaction IDs).  The other 7 UTXOs were not spent by 90d0 and are still unspent as of this writing.
Nate Eldredge
CC BY-SA 3.0
2016-11-19T20:06:19.437Z
Thanks. Those transactions which have the address as the receiver are the UTXOs I was looking for. I was confused and thought it would be somewhere else.
Gradient
CC BY-SA 3.0
2016-11-19T16:06:41.813Z
2016-11-19T16:06:41.813Z
Nate Eldredge
<p>I have read <a href="https://bitcoin.stackexchange.com/q/39323/43349">this question</a> that asks if all UTXOs in an address are sent to a change address or only the UTXO involved in the transaction.</p>

<p>As part of a spending transaction, the public address is revealed. And that is part of the reason people suggest not to reuse an address.</p>

<p>My questions are:</p>

<ol>
<li>Are all UTXOs (even those not part of the transaction) sent to a change address or only the one involved in the transaction? (This was not really answered in the linked question.)</li>
<li>If only the one involved in the transaction is sent to a change address, is it not a security risk? The remaining UTXOs left in the bitcoin address now have their public key made public.</li>
</ol>

<utxo><change>
UTXO all sent to change address?
Gradient
# UTXO all sent to change address?

(Asked by: username_0 on 2016-11-19)

I have read [this question](https://bitcoin.stackexchange.com/q/39323/43349) that asks if all UTXOs in an address are sent to a change address or only the UTXO involved in the transaction.

As part of a spending transaction, the public address is revealed. And that is part of the reason people suggest not to reuse an address.

My questions are:

1. Are all UTXOs (even those not part of the transaction) sent to a change address or only the one involved in the transaction? (This was not really answered in the linked question.)
2. If only the one involved in the transaction is sent to a change address, is it not a security risk? The remaining UTXOs left in the bitcoin address now have their public key made public.

**Tags:** utxo, change


---

## 1 answers

### Answer by username_1 on 2016-11-19. Score: 0 | Accepted answer

It is always up to the wallet client to decide which UTXOs are to be spent. The protocol certainly doesn't require all UTXOs of an address to be spent at the same time. A particular wallet client could be coded to do that, but I don't know of any that are.

[Here](https://testnet.blockexplorer.com/address/moooopfhBjQDSJQuCj4aVr6s4b5pFbQin4) you can see a testnet example. Transaction `90d042b...` spent only 2 of the 9 UTXOs available in address `moooopfhBjQDSJQuCj4aVr6s4b5pFbQin4`. This transaction was created with just the ordinary `sendtoaddress` command in Bitcoin Core, no special options.

This isn't a significant security risk. In a secure digital signature protocol, it should be infeasible to generate a valid signature without access to the private key, even if the public key is known. That's what "public" means! As far as we know, ECDSA is secure, so revealing the public key doesn't harm security.

Some people believe in planning for the possibility that an attack might someday be found on ECDSA. If so, then there would be some advantage in not having revealed your public key. After a new signing algorithm is incorporated into Bitcoin, you could create a transaction sending your coins to an address which uses the new algorithm. This would reveal your public key and attackers could get started, but assuming the attack is fairly computationally intensive, you hope your transaction would be confirmed before an attacker could successfully create a forged signature on a transaction that would send your coins to him.

The tradeoff of this approach is that, as you note, as soon as you want to spend any coins from an address, you have to spend all the UTXOs. This increases the size of the transaction and thus costs you more in fees. That's why most clients don't do it; the security improvement is theoretical at best, but the costs are real.

> **Comments:**
> **username_0**: Thanks, it is clear now. One small question: In the link you provided to a testnet transaction, how can you see the 9 UTXOs available to the address? I could find the 2 you mentioned in the transaction but not the 9 available.  
> **username_1**: @username_0: Keep scrolling down.  
> **username_0**: I don't see what you mean. I only see the transactions on the page you linked.  
> **username_1**: @username_0: There are a total of 10 transactions shown on that page, in reverse chronological order.  The most recent one is 90d0.  At the time of that transaction, the other 9 were already available and unspent: 932c, 1f19, fdba, f643, 7142, 53f9, 9579, b5a9, ba6d.  90d0 only spent 932c and b5a9 (expand 90d0 and click the arrows to get the transaction IDs).  The other 7 UTXOs were not spent by 90d0 and are still unspent as of this writing.  
> **username_0**: Thanks. Those transactions which have the address as the receiver are the UTXOs I was looking for. I was confused and thought it would be somewhere else.  

---

