Originally published in October 2015, this blog post has recently been updated for 2020.

Bitcoin Transaction Malleability sounds like an intimidating concept, but it’s actually quite simple.

Malleability refers to the “capability of being influenced or altered by external forces.” It’s a term that’s often thrown around when you’re talking about metals (steel, tin, etc.), but it also applies to less physical concepts such as memories (the malleability of the mind). 

Since the birth of bitcoin, however, malleability has made its way into BTC transactions as well.

So what does bitcoin malleability mean? Before we get into that, let’s go over how bitcoin transactions work one more time. 

How bitcoin transactions work—an overview

In our previous article, we went over what goes on behind a bitcoin transaction, but let’s briefly go over it again before we touch on malleability.

Bitcoin transactions are a unique kind of transaction that was brought to us by Satoshi Nakamoto in 2009. When you send BTC from one wallet to another, it doesn’t follow the usual process of the currencies we’re used to.

What we’re used to: Funds are withdrawn from an account and sent along imaginary wires to another account.

Bitcoin transactions: Transactions are created on the blockchain and confirmed by nodes on the network.

We can think of the bitcoin blockchain as a ledger for the entire network, allowing us to see a record of all transactions—inputs, outputs, and amounts.

Each transaction is uniquely identifiable, allowing them to be referenced in the blockchain. An individual transaction ID (TX ID) is then generated by running all the included information through a hash function.

In essence, hashing takes all the information and compresses it into smaller packages—it’s like compressing files on a computer into a zip file. However, unlike its computer counterpart, hashes are entirely unpredictable, meaning that it’s impossible to know what the hash will look like—even with all the information you have.

Hashes have a ripple effect on them—if any detail or piece of information is changed within the transaction, the hash changes entirely. Because of that ripple effect, TX IDs are impossible to falsify—each transaction has only one possible hash.

That’s basically the idea of how bitcoin transactions work. However, this is also where malleability comes in.

What is bitcoin transaction malleability?

Bitcoin transaction malleability is an attack wherein someone changes a TX ID before it is confirmed or validated by the network. Once a part of that TX ID is changed, that ripple effect affects the hash—and if the hash is altered, the transaction can’t be confirmed. This change in the hash can create problems, especially for people making use of an exchange.

For example, let’s say Diana runs a BTC exchange, with Bella having funds stored within that exchange. One day, Bella decides to withdraw her BTC and asks Diana to send it to her address. As soon as Diana sends the bitcoin, a transaction is created on the blockchain. However, before it’s added to the current block, it will have to be confirmed by miners.

What if Bella decides to pretend that Diana never sent over the BTC? She can use the bitcoin malleability issue to replicate Diana’s original transaction by slightly tweaking the transaction details—effectively changing the hash. Bella then retransmits that transaction with a new ID.

There’s a chance that Bella’s transaction (the new ID) will be confirmed first and therefore, regarded as valid. If that happens, Bella can then complain that she never received the BTC and when Diana checks the blockchain for her original TX ID, she won’t find it. Diana will then send more BTC, effectively paying double what she was supposed to send out.

However, these issues of bitcoin malleability aren’t always malicious. Sometimes, they’re accidental. Some people use custom software to handle their own BTC and that can cause problems. Other wallets might not be compatible, forcing them to “fix” the TX ID. The ID is then formatted and changed, causing the malleability issue once again.

So what happens to the people who fall victim to this issue? In some cases, their transactions are stuck in limbo. In other cases, their wallets might think they still have those coins to spend. Although it might not be an enormous deal to the casual trader sitting at home, this issue could significantly affect merchants who offer goods and services in exchange for BTC. These merchants probably won’t want to accept a transaction without confirmations if there’s a small chance that a miner might malleate it.

It affects everyone

Unfortunately, this type of attack is nothing new to the crypto space—some even blame this issue for the case of the infamous Mt. Gox.

Luckily, bitcoin transaction malleability doesn’t necessarily mean lost funds. However, it can slow down the entire network. Five years ago, Paxful felt the effects of this type of attack—outgoing transactions weren’t appropriately processed and some ended up double-spending. Fortunately, it was fixed, and all those who were affected were refunded.

Addressing the issue

For many years, the bitcoin community has explored many ways to fix this hole in the system.

At this point in Bitcoin’s lifespan, maybe the best thing to do is nothing. Right now, the only worthwhile benefit for fixing this issue is to solidify zero-confirmation reliability.

Putting this issue at the top of our priorities is like caring for the cart before the horse. Take care of the horse first, which, in this case, could be bitcoin adoption.

It’s more of a theoretical problem than a real one, making these the key takeaways, at least for now:

• Zero-confirmation transactions should not be trusted
• Sometimes, this issue will create slower transactions, but that’s nothing compared to lost funds 
• Transaction IDs are not always correct

When it comes to malleating transactions, people have very little to gain, meaning the only reason they would do so is to prove a point—in most cases, for political reasons (which has happened in the past).

It’s a good thing that bitcoin transaction malleability is an attack that doesn’t happen very often. Even if miners were doing it regularly, you’d only be affected if you dealt with a transaction with an unconfirmed parent. If that were to happen, in most cases, the funds would go back into your wallet since the transaction would be invalidated.

Luckily, you don’t have to worry about it too much. However, it’s never a bad idea to keep yourself informed. In this trading space, it could save you from careless losses, which is priceless.