UTXO stands for Unspent Transaction Output. On Bitcoin, every spendable “coin” is really a specific output from a previous transaction that has not yet been used. A wallet does not spend a balance in the abstract; it selects one or more UTXOs, proves control of them with a signature, and creates new outputs in a fresh transaction.
UTXOs matter in security because they define what can be spent and how funds move on-chain. Attackers who gain access to a seed, private key, or signing device can sweep many UTXOs quickly, often consolidating them into new addresses. Defenders and analysts track UTXO movement to spot unauthorized transfers, change outputs, and unusual wallet behavior. In safe workflows, users verify the exact UTXOs being spent, review outputs on the hardware wallet, and use PSBT-based signing to reduce the chance of approving a malicious transaction.