Coinbase Transactions

Every transaction we’ve studied so far obeys the conservation rule: inputs must be ≥ outputs, so no value is created. But that raises an obvious question — if no transaction can mint coins, where do new bitcoins come from? They come from exactly one privileged transaction per block, the coinbase transaction, which is the sole, protocol-sanctioned exception to conservation. This page dissects it.

The first transaction in every block

Every block’s transaction list begins with a coinbase transaction (and contains exactly one). It is the miner’s reward, and the only way new supply enters existence:

   BLOCK
   ├── tx[0]  ← COINBASE  (creates new coins: subsidy + fees → miner)
   ├── tx[1]  ← ordinary transaction
   ├── tx[2]  ← ordinary transaction
   └── ...

Its output value is allowed to be:

   coinbase output  ≤  block subsidy  +  sum of all fees in the block

The block subsidy is the freshly-minted portion, set by the protocol and cut in half roughly every four years (every 210,000 blocks) — the famous halving that drives Bitcoin toward its 21-million cap, detailed in halving & issuance. The fees are the gaps left by every other transaction in the block (recall fees are implicit). The miner sweeps both into the coinbase outputs, paying themselves. If a miner under-claims (e.g. forgets some fees), the unclaimed amount is simply lost — burned forever.

Why coinbase is the only exception to conservation

Ordinary transactions can’t create value because that would be counterfeiting. The coinbase can, because new issuance is the entire mechanism by which the ledger pays for its own security — it compensates miners for the energy that makes Nakamoto consensus work. Issuance isn’t a loophole; it’s the budget.

The phantom input

A coinbase transaction is structurally odd: it has inputs, but it isn’t spending anything. There is no prior coin for new money to come from. So its single input is a placeholder that points at nothing:

   COINBASE INPUT
   ├── previous output txid : all-zeroes  (0x0000...0000)
   ├── previous output vout : 0xffffffff  (the "null" index)
   └── coinbase field       : ARBITRARY DATA  (not a real scriptSig)

Because there’s no real outpoint to reference, the txid is set to all zeros and the index to the maximum value — a sentinel that says “this is not a normal spend.” Validating nodes recognize this shape and apply the special issuance rules instead of the conservation rule.

The coinbase field and the extranonce

Where an ordinary input would carry an unlocking script, a coinbase input carries an essentially free-form data field (the coinbase field). It has two famous uses:

1. Messages. The very first block’s coinbase field contained the now-iconic newspaper headline “The Times 03/Jan/2009 Chancellor on brink of second bailout for banks,” timestamping the genesis block. Mining pools still stamp identifiers here.
2. The extranonce. This is the load-bearing one. When a miner exhausts all ~4 billion values of the block header’s 32-bit nonce without finding a valid hash, it needs more room to search. It mutates a counter — the extranonce — inside the coinbase field. Changing the coinbase field changes the coinbase transaction, which changes the block’s Merkle root in the header, which gives the miner a fresh ~4-billion-value nonce space to grind. The extranonce is, in effect, the high bits of the mining search.

   nonce exhausted (2^32 tries)?
        │
        ▼
   bump extranonce in coinbase field
        │
        ▼
   coinbase tx changes → Merkle root changes → header changes
        │
        ▼
   a whole new 2^32 nonce space to search

The 100-block maturity rule

Coinbase outputs come with a unique restriction: they cannot be spent until 100 additional blocks have been built on top of the block that created them (roughly 100 × 10 minutes ≈ 16–17 hours).

   block N    : coinbase coins created  (immature, unspendable)
   block N+1 ... N+99 : still maturing
   block N+100: coins are MATURE → now spendable

The reason is reorganizations. If two miners find blocks at nearly the same time, the chain can temporarily fork, and a block (with its coinbase reward) can end up orphaned — discarded when the network converges on the longer chain. If a miner could immediately spend a freshly-minted reward and that block were then orphaned, the spent coins would vanish, and anyone who accepted them would be left with worthless inputs. The 100-block delay ensures a coinbase reward is buried deeply enough that a reorg undoing it is, for practical purposes, impossible — so by the time the coins are spendable, their existence is settled.

Maturity applies to coinbase outputs only

Ordinary transaction outputs are spendable as soon as they confirm (subject to your own confirmation policy). The 100-block lock is a special rule for newly-minted coins precisely because they are the ones most exposed to being erased by a reorg.

By the numbers — the subsidy halving schedule

The freshly-minted part of the coinbase started at 50 BTC and is cut in half every 210,000 blocks (~4 years):

block       0  (2009)   subsidy 50      BTC
block 210,000  (2012)   subsidy 25      BTC
block 420,000  (2016)   subsidy 12.5    BTC
block 630,000  (2020)   subsidy 6.25    BTC
block 840,000  (2024)   subsidy 3.125   BTC   ← current, as of the mid-2020s

The geometric sum of all these halvings converges to just under 21 million BTC, the entire supply — a cap no central authority maintains; it is simply what every node computes the subsidy to be at each height. After 33 halvings (around the year 2140) the integer-satoshi subsidy rounds to zero and fees alone pay miners. The full schedule and its economics live in halving & issuance.

It actually happened — two coinbases with the same txid (2010)

Early coinbase transactions could be byte-for-byte identical if two miners used the same empty coinbase field and the same reward address — and identical bytes mean an identical txid. It happened twice in 2010: the coinbase of block 91842 exactly duplicated block 91812’s, and block 91880 duplicated block 91722’s. Because a UTXO is keyed by its outpoint, the later duplicate overwrote the earlier one in the unspent set, quietly destroying ~50 BTC each time. The fix came as two soft forks: BIP 30 forbade a block from containing a duplicate of an existing unspent txid, and BIP 34 required every coinbase to embed its block height, which guarantees every coinbase txid is unique forever. A neat reminder that even the “trivial” minting transaction needed hardening.

The thread

How do coinbase transactions help untrusting strangers agree on one ledger? They make new-money creation transparent, capped, and self-verifying. Every node independently checks that each block’s coinbase claims no more than subsidy + fees, that the subsidy matches the halving schedule for that height, and that no coinbase coins are spent before maturing. There is no central mint to trust and no way to sneak extra coins past the network — issuance is a number every participant can recompute and enforce. The coinbase is simultaneously the incentive that pays miners to secure the ledger and the only sanctioned source of new supply, and both facts are enforced by the same universal, trustless arithmetic that governs every other transaction.

The architect’s lens

Step back from the phantom input and answer the five questions an architect asks of any privileged exception:

• Why does it exist? It is the only protocol-sanctioned way new bitcoins enter existence — the single transaction per block allowed to break the conservation rule, paying the miner subsidy + fees for securing the chain.
• What problem does it solve? Funding the ledger’s own security without a central mint: issuance isn’t a loophole, it’s the budget that compensates miners for the energy behind Nakamoto consensus, and the halving schedule makes that budget shrink predictably toward the 21-million cap.
• What are the trade-offs? Structural oddities to make the exception safe — a phantom input (all-zero txid, 0xffffffff index) that spends nothing, a 100-block (~16–17 hour) maturity lock, and a free-form coinbase field doing double duty as message and extranonce search space.
• When is it the wrong design? A pre-mined or fixed-supply chain needs no per-block minting transaction at all — coins are allocated once at genesis. The coinbase exists because Bitcoin’s supply is issued gradually as a mining incentive rather than minted up front.
• What breaks if I remove it? There is no other source of new coins, so issuance — and the miner reward that pays for proof-of-work — vanishes. Drop the maturity rule instead and a freshly-minted reward spent before a reorg could be erased, leaving its recipients with worthless inputs.

Check your understanding

1. Why is the coinbase transaction allowed to violate the conservation rule when no other transaction is?
2. What is the maximum value a coinbase transaction may pay out, and what are its two components?
3. Describe the coinbase input. Why does it point at an all-zero txid and the 0xffffffff index?
4. What is the extranonce, and how does bumping it give a miner a fresh nonce search space?
5. Why must coinbase outputs wait 100 blocks to be spendable, and what risk does that mitigate?

Show answers

1. New issuance is the entire mechanism by which the ledger pays for its own security — it compensates miners for the energy that makes Nakamoto consensus work. Ordinary transactions creating value would be counterfeiting; the coinbase’s exception isn’t a loophole, it’s the budget, and it’s the only protocol-sanctioned source of new supply.
2. The maximum is block subsidy + sum of all fees in the block. The subsidy is the freshly-minted portion set by the protocol and halved every 210,000 blocks (the halving); the fees are the gaps left by every other transaction. Under-claiming simply burns the unclaimed amount.
3. The single input is a placeholder that spends nothing: its previous-output txid is all-zeros (0x0000...0000) and its index is 0xffffffff. Since there’s no real prior coin to reference, this sentinel shape tells validating nodes “this is not a normal spend,” so they apply the special issuance rules instead of the conservation rule.
4. The extranonce is a counter inside the free-form coinbase field. When a miner exhausts all ~4 billion values of the 32-bit header nonce, bumping the extranonce changes the coinbase transaction → changes the block’s Merkle root → changes the header, handing the miner a fresh ~4-billion-value nonce space to grind. It is effectively the high bits of the mining search.
5. The risk is reorganizations: a block (and its coinbase reward) can be orphaned when the network converges on a longer chain. Waiting 100 blocks buries the reward deeply enough that a reorg undoing it is practically impossible, so by the time the coins are spendable their existence is settled — preventing a spent-then-vanished reward from leaving recipients with worthless inputs.