 Yanis has a third question. How can I manually construct a transaction with multiple inputs? Or is this being done by the blockchain? Yes, you can manually construct transactions. You can do that with a variety of wallets that allow you to manipulate the transaction on a fine level. For example, the Electrum wallets, as well as many web-based wallets and command-line wallets, allow you to control the construction of the transaction down to which inputs are included. You can do that manually. This isn't done by the blockchain, it's done by wallets. Some wallets will allow you to do that. Of course, most wallets don't. They do this for you. They will select inputs based on an algorithm that allows them to construct a transaction that is not too expensive or too bloated. For example, if you have exact change, you will use that input to make your payment, considering fees, of course. But if you don't, and you need more than one input in order to make a payment, because you have lots of smaller amounts in your wallet, then your wallet will construct a transaction with multiple inputs, so it can put together enough money to make the payment you are trying to do. That's how these transactions are constructed. You don't have to do it, but you can with some wallets. In many cases, you will see it in a menu or an option in the wallet called Coin Selection. The ability to do coin selection is basically this. To construct a transaction with multiple inputs, manually select the inputs. Anya asks, I still don't quite understand the concept of change on the blockchain. If Satoshi wanted to send 10 bitcoin to Hal Finney, why did this result in a transaction of 50 bitcoin, with 40 bitcoin and change? Why isn't it a single transaction of 10 bitcoin? Is the input for a transaction derived from the total content of a wallet or from the last amount received? In other words, did Satoshi already own 100 bitcoin by that point, from, let's say, 2 bitcoin each? Would the input be 100 bitcoin or 50, because that's the last amount he received? Anya, right in that question, you've already planted the seed of your answer. Bitcoin uses a ledger, and that ledger tracks the last amount received as a unique and indivisible coin. We call that the UTXO model. UTXO stands for an unspent transaction output. An unspent transaction output is the specific amount you received in a previous transaction to that address. That specific amount, that unique amount, is what you spend in the next transaction, and you can only spend all of it. Transactions move chunks of bitcoin. In a transaction, you can split a chunk of bitcoin into more than one, or you can join multiple chunks of bitcoin into one. But every chunk or UTXO that you spend from a previous transaction, the last transaction you receive, for example, has to be spent as a whole. Let's say Satoshi has previously received 100 bitcoin before sending 10 bitcoin to Hal. How has Satoshi received this? In two different transactions, her 50 bitcoin each. Each of those transactions created a 50 bitcoin unspent transaction output. Satoshi's wallet can spend either one, the other, or both of those 50 bitcoin transaction outputs, by referencing them as inputs in a future transaction. When Satoshi wants to give Hal 10 bitcoin, Satoshi doesn't have a 10 bitcoin UTXO. It doesn't have a 10 bitcoin chunk from a previous transaction. Satoshi has two 50 bitcoin chunks. That transaction will then take one of those 50 bitcoin chunks and split it into two outputs. One that goes to Hal for 10 bitcoin, and one that goes to Satoshi back as change for 40 bitcoin. Now, at this point, Hal has a 10 bitcoin chunk to spend. Satoshi has a 50 bitcoin chunk that was left from before, and a 40 bitcoin chunk that he sent back as change. Therefore, that's what's available to spend for the next transaction. Let's say Hal wants to pay one bitcoin. The only output that Hal has in his wallet now is a 10 bitcoin chunk. In order to pay someone one bitcoin, Hal would have to create a transaction that spends that 10 UTXO, and gets one bitcoin as payment, and nine bitcoin as change. Everything in bitcoin is basically unspent transaction outputs. The only unit of currency that really exists in bitcoin is the outputs of transactions, which are these chunks of bitcoin that are indivisible and can only be spent as a whole. That way, when you are looking at the blockchain from the perspective of a wallet or database, you are looking at all of the transactions that can happen. Transactions can only exist in one of two states. They are either spent or they are unspent. There is no in-between. You can't have a transaction output that is half spent. It makes it a lot easier to manage the database if you simply have all of these units of bitcoin, and you figure out which ones have been spent by new transactions, and which ones have not been spent, and are available to spend. If you had to do math to figure out what part of a previous transaction output is spent or not spent, it would make the system a lot more complicated. It would also make it much more difficult to track double-spends, and everyone validating a transaction would have to do a lot more math to figure it out, because they would have to look at all of the balance stored in the wallet across all of the transactions just to validate one transaction. Instead, because of the way this model works, if I am validating one transaction, all I need to do is look at the input that references and see if that particular input has been fully spent or not spent, and I don't have to do any math. It either has been spent or it hasn't, and that's the only input I need to look at.