Cashu

Cashu is a free and open-source Chaumian ecash protocol for Bitcoin. A user pays a Lightning invoice to a "mint," which issues ecash tokens of equivalent value; those tokens can then be sent, received, and stored privately, and later redeemed back to Lightning. Because the protocol is open, anyone can run a mint, wallets from different developers interoperate, and no company sits at the center of the system.

How the protocol works

Cashu is built on a blinded signature scheme — a blinded Diffie–Hellman construction based on David Wagner's variant of Chaumian blinding. The wallet generates a secret, blinds it, and presents only the blinded form for the mint to sign; the wallet then unblinds the signature locally. The result is a token the mint provably issued but cannot recognize: it cannot tell which token it signed, who holds it, or link redemption back to issuance. When a token is spent, the mint checks two things only — that the signature is its own and that the token's secret has not appeared in its list of already-spent secrets. That spent-list check prevents double-spending without the mint ever seeing accounts or balances. Tokens are denominated in fixed amounts (powers of two), and wallets make change by having the mint swap tokens for fresh ones of new denominations — again blind.

Specifications and ecosystem

The protocol is defined by a set of specifications called NUTs (Notation, Usage, and Terminology), which keep independent wallets and mints compatible — the mandatory core covers minting, swapping, and melting (redeeming to Lightning), while optional NUTs add features mints can advertise. This spec-first structure has produced a genuinely plural ecosystem: multiple wallet implementations across platforms, multiple mint implementations, and integrations with Nostr clients, where ecash's bearer nature suits tipping and small payments between pseudonymous identities.

The trust model, honestly stated

Cashu mints are typically single-operator, so users place custodial trust in one party for the bitcoin backing their tokens — a mint that disappears or refuses redemption takes the value with it, and blinding makes outside auditing of a mint's reserves inherently hard. The protocol's answer is not to eliminate that trust but to shrink and distribute it: mints are cheap to run, so users can hold small balances across several, treating each like a cash wallet rather than a bank. Security researchers have publicly disclosed and helped patch protocol vulnerabilities over time, which reflects an actively maturing standard rather than a settled one. For guarding meaningful savings, self-custody remains the answer; Cashu is for the spending layer.

Why it matters

Cashu and the federated Fedimint design are the two most prominent Bitcoin ecash systems, and they attack the same problem from different angles: Fedimint distributes each mint's custody across guardians, while Cashu multiplies small independent mints. Both move everyday spending off the public ledger entirely — complementing on-chain tools like CoinJoin — and both are bets that cash-like digital privacy is worth a bounded, eyes-open dose of trust.

Running a mint yourself is the logical endpoint for the self-hosting crowd: a small community — a family, a hackerspace, a village market — can operate its own mint on modest hardware next to the household node, keeping the custody relationship between people who already trust each other rather than with a stranger on the internet. That pattern, many small mints embedded in real communities, is the decentralization story Cashu's designers had in mind, and it is a very different topology from one giant custodian — closer in spirit to how cash itself once circulated. It also keeps the failure domain small and legible: if a community mint fails, the people affected know exactly whom to ask why — which is more accountability than most custodians on the internet have ever offered.