Bitcoin eCash Compared: Cashu vs Fedimint — And Why It Is Custodial

Bitcoin eCash is having a moment — Cashu mints and Fedimint federations promise the privacy and instant, near-free payments that base-layer Bitcoin can’t. And they deliver, genuinely. But a self-sovereignty-first site owes you the sentence the hype tends to skip: eCash is custodial. You hold blinded bearer tokens — IOUs — and a mint or a federation of guardians holds the actual bitcoin. This comparison scores the real implementations on how concentrated that trust is, and leads with the caveat rather than burying it.

Quick answer

Before any feature comparison, the one thing you must understand about Bitcoin eCash: it is CUSTODIAL. Cashu and Fedimint give you genuinely excellent payment privacy, instant settlement and near-zero fees — but you hold blinded bearer tokens (IOUs), not bitcoin, and a mint or federation holds the actual coins. If that custodian steals, gets hacked, gets seized, or simply vanishes, your money is gone, and no seed phrase brings it back. The two models differ in HOW concentrated that trust is: Cashu is a single mint operator who can rug 100% unilaterally, while Fedimint splits custody across an M-of-N federation of guardians where a threshold quorum must collude to steal — safer, but still not self-custody. Lost bearer tokens are usually unrecoverable, and even the seed-restore that exists only works if you set the seed BEFORE loading value and the mint is still online.

eCash is spending money, not savings. Use it for small day-to-day amounts where privacy and speed beat sovereignty; keep anything you can't afford to lose in self-custody (cold storage or Lightning you control). If you do use it, prefer a well-run Fedimint federation over a single Cashu mint, keep balances small, and set your recovery seed before you load a single sat.

🔴 eCash is not self-custody. A mint operator (Cashu) or federation of guardians (Fedimint) holds your bitcoin and can lose, steal or freeze it. Lost bearer tokens are usually gone for good. Use for small spending amounts only.

Implementation	Custody	Trust model & guardians	Backup / recovery	P2PK / HTLC	Maturity
Fedimintprotocol	custodial (federated)	Custody is SPLIT across a federation of guardians under M-of-N Byzantine-fault-tolerant consensus (typically ~3f+1 guardians tolerating f faulty; stealing needs a threshold quorum, commonly >2/3, to actively collude). No single guardian can steal or censor alone — but it is still NOT self-custody: a colluding quorum CAN rug, guaranteed only by the guardians' real-world trust, not by code.Guardians: Federated M-of-N — multiple independent guardians must reach a signing threshold. A 1-guardian 'federation' is just Cashu with extra steps; security scales with how many truly-independent guardians it has.	Best-in-class among eCash: 12/24-word seed deterministically regenerates secrets, and encrypted backups can be stored with guardians so a quorum assists restore after device loss. Still requires the federation to be alive.	Lightning HTLC via the gateway for LN interop; general P2PK-locked bearer notes are not the core UX (unlike Cashu NUT-11). Module system extensible; parity detail unverified.	productionMIT · A
The federated M-of-N model: meaningfully harder to rug than a single mint, but a colluding guardian quorum still can — trust is distributed, not eliminated.
Fediapp	custodial (federated)	Custodial via the underlying Fedimint federation — M-of-N guardians hold the bitcoin. Fedi the company does not custody your funds; your community's guardians do. Fedi states plainly the ONLY guarantee against guardian fraud is real-world offline trust, not code.Guardians: Federated M-of-N (inherits Fedimint). Decentralization depends entirely on how independent the specific community's guardians are.	Seed-phrase backup + encrypted backups stored with guardians so a quorum assists recovery after device loss — one of the more forgiving recovery stories, still federation-dependent.	Inherits Fedimint's LN/HTLC gateway interop; not marketed as a P2PK note-locking wallet. Detail unverified.	productionAGPL-3.0 (full stack open-sourced 3 Jan 2026, the Bitcoin genesis anniversary) · A
Packages community custody with a friendly UX, but it is OTHER PEOPLE holding your bitcoin — safer than a single mint only to the exact degree your guardians are trustworthy and independent.
Cashuprotocol	custodial (single mint)	🔴 CUSTODIAL, single-operator. The mint operator holds ALL the backing bitcoin and can steal 100% of it at any time — the protocol has ZERO technical safeguard against the operator rugging or vanishing. Chaumian blinding protects your privacy, not your funds.Guardians: Single mint operator. ONE entity holds custody and can rug or censor unilaterally — no federation, no M-of-N, no quorum.	🔴 Tokens are bearer secrets on-device. Deterministic seed restore (NUT-13) exists but ONLY if the seed was created BEFORE the eCash, AND needs the mint online + cooperating. Lose the device with no prior seed, or the mint disappears, and the money is gone permanently.	Yes, both — NUT-11 P2PK (lock to a pubkey, with locktime + n-of-m multisig + refund keys) and NUT-14 HTLC (atomic swaps). Tightened P2PK/HTLC rules were in flight (PR #315, Nov 2025) — merge status unverified.	betaMIT · A
The single-mint model: simplest and HIGHEST rug risk. You are lending bitcoin to one operator for privacy and instant/cheap payments — not holding it.
Nutshellmint	custodial (single mint)	Custodial single-operator (a Cashu mint). Whoever runs the Nutshell instance holds all backing bitcoin and can steal it. The software does not remove custodial trust — it implements it.Guardians: Single operator — no federation; one admin controls the funds and the Lightning backend.	NUT-13 deterministic secrets (landed v0.13). Operators must independently back up the mint's keys/DB or user funds are unrecoverable; user recovery needs this mint online.	Yes — reference implementation of NUT-11 P2PK + NUT-14 HTLC; ~v0.20 (early 2026) reported improved validation (version unverified).	betaMIT · B
Being the reference implementation changes nothing about custody — a Nutshell mint is a single custodian who can run off with the sats.
CDK (Cashu Dev Kit)mint	custodial (single mint)	Custodial single-operator when used to run a mint. The library is neutral, but any mint built on it is a single custodian that can rug; wallets built on it inherit the custody of whatever mint they connect to.Guardians: Single operator for a CDK-based mint — no federation model.	Wallet libs support NUT-13 restore (seed-first + mint-online caveats apply). Bearer-token loss risk unchanged.	Yes — NUT-11 P2PK + NUT-14 HTLC; ships mobile bindings (Swift/Kotlin) for native wallets.	betaMIT · B
A better-engineered way to run a Cashu mint is still a single-custodian mint — CDK does not add federation or reduce rug risk.
Cashu.mewallet	non-custodial client / custodial mint	Non-custodial CLIENT, but funds live in whatever Cashu mint you connect to — a single custodian that can rug. The wallet holds bearer secrets in the browser; the mint holds the bitcoin.Guardians: Depends on the chosen mint (single operator each). Multi-mint spreads risk, but each mint is its own single point of failure.	🔴 Seed backup/restore (NUT-13); seed must exist BEFORE the eCash and the mint must cooperate/be online. Clearing browser data without a prior seed = permanent loss.	Receive/send P2PK-locked tokens depending on version; HTLC tied to mint. Per-feature unverified.	betaMIT · B
Browser storage of bearer tokens is fragile — no seed set beforehand means one cache-clear wipes the money.
Minibitswallet	non-custodial client / custodial mint	Non-custodial mobile CLIENT; the connected Cashu mint(s) custody the bitcoin and can rug. Adds Lightning addresses and Nostr zaps on top.Guardians: Single operator per mint; multi-mint spreads across independent single custodians.	Seed-phrase eCash recovery to restore balance after device loss (seed-first + mint-cooperation caveats).	P2PK/HTLC depends on mint + app version — unverified.	betaopen source (mobile) · C
Slick UX and Lightning addresses do not change the fact that a single mint holds the sats and can disappear.
eNutswallet	non-custodial client / custodial mint	Non-custodial mobile CLIENT; funds custodied by the connected Cashu mint(s), which can rug. Multi-mint by design.Guardians: Single operator per mint; risk spread across multiple independent single custodians.	Seed-based restore (NUT-13 pattern); bearer-token loss risk if no seed set first / mint offline.	Mint/version-dependent — unverified.	betaopen source (mobile) · C
Multi-mint diversification reduces single-mint blast radius but every mint you use is still a custodian that can steal its share.
Nutstashwallet	non-custodial client / custodial mint	Non-custodial CLIENT (web/app); connected Cashu mint(s) hold the bitcoin and can rug.Guardians: Single operator per mint; multi-mint spreads across independent single custodians.	Early adopter of BIP32/BIP39 deterministic seed recovery for eCash; seed-first + mint-cooperation caveats still apply.	Mint/version-dependent — unverified.	betaopen source · C
Recovery-from-seed is real but conditional — it needs the mint alive and the seed created before the tokens; it is not Bitcoin-grade self-custody.

Cashu vs Fedimint. Cashu = a SINGLE mint operator holds everything and can rug unilaterally; simpler and more flexible (rich P2PK/HTLC), but the highest trust concentration and the bearer-token loss problem is acute. Fedimint = a FEDERATION of M-of-N guardians under BFT consensus; no single guardian can steal or censor, recovery is more robust (seed + guardian-assisted backups), and it targets community-scale trust — but a colluding guardian quorum can still rug, so it distributes custodial trust rather than removing it.

Where it fits. Treat eCash as SPENDING MONEY, not savings: a genuinely useful tool for small day-to-day amounts where privacy, speed and low fees matter more than sovereignty. It is custodial — you are trusting a mint or federation with your bitcoin and it can be lost or stolen — and it is never a replacement for cold storage or Lightning self-custody. Prefer Fedimint's federated model over a single Cashu mint when custody matters, keep balances small, always set the recovery seed BEFORE loading value, and treat any mint as a counterparty that can fail.

Open data (CC BY 4.0): CSV · JSON · API: /wp-json/dc/v1/ecash-comparison

Single mint vs federation: the trust axis that matters

The two protocols draw the custodial line in very different places. Cashu is the simplest and the riskiest: a single mint operator holds all the backing bitcoin and can steal every satoshi at will — the protocol offers no technical safeguard against a rug, only whatever reputation the operator has. Its upside is flexibility (rich P2PK and HTLC token locking) and a thriving ecosystem of independent mints and wallets. Fedimint splits custody across a federation of guardians under Byzantine-fault-tolerant consensus: no single guardian can move funds, and a threshold quorum — usually more than two-thirds — must actively collude to steal or censor. That’s meaningfully harder to rug and comes with more robust, guardian-assisted recovery, which is why Fedimint targets community-scale custody. But make no mistake: a colluding quorum still can rug, so Fedimint distributes custodial trust rather than removing it. A one-guardian “federation,” incidentally, is just Cashu with extra steps.

The bearer-token trap

The failure mode that catches newcomers isn’t a dramatic exit scam — it’s losing a phone. eCash tokens are bearer secrets stored on your device, and if you lose the device the money is usually gone. Seed-phrase recovery exists (Cashu’s NUT-13, Fedimint’s guardian-assisted backups), but it comes with conditions people miss: on Cashu the seed must have been created before you loaded any value, and the mint must still be online and cooperating to restore. Clear your browser storage on a web wallet with no prior seed, and you’ve deleted money. Fedimint’s recovery story is the best in the category, but it still depends on the federation staying alive. The practical rules that follow are simple: set your recovery seed before you load a single sat, keep balances small, and never treat an eCash balance as savings.

Used within those limits, eCash is a real tool — private, instant, cheap spending money for day-to-day amounts, and a legitimately useful complement to a sovereign stack. It just isn’t a place to store wealth. For the wealth side, keep your bitcoin in self-custody: compare wallets in the wallet sovereignty matrix, plan the handover with the inheritance planner, and pick a signer in the signing devices comparison. For on-chain payment privacy that stays non-custodial, see the Silent Payments wallet matrix. eCash for spending, self-custody for saving — that’s the whole framework.

Related products, repair, and setup paths

Last reviewed July 18, 2026.