Fedimint

Fedimint is an open-source protocol for running federated Chaumian ecash mints on Bitcoin. It lets a community — a family, a village, a group of friends who already trust each other — establish a privacy-preserving custody arrangement operated not by one party but by a group of "guardians." Users deposit bitcoin into the federation and receive blind-signed ecash notes that are one-to-one claims against those deposits, redeemable on-chain or over the Lightning Network. The design goal is blunt and honest: most people will not achieve perfect self-custody on day one, so give them a second-best option where trust is spread across known community members instead of concentrated in a distant exchange.

The guardian model

Where a single-operator design like Cashu relies on one mint, Fedimint distributes custody across a threshold of guardians — typically four or more, each running their own server, ideally on separate hardware in separate locations. Deposits sit in a federation-controlled multisignature arrangement, and a quorum of guardians must cooperate to sign withdrawals or issue notes; the federation's consensus tolerates a minority of guardians being offline, compromised, or dishonest. No single guardian can steal funds or unilaterally censor a member, and no single crashed server halts the mint. Guardians also assist with encrypted backup and recovery, softening one of self-custody's sharpest edges. The trust model is explicit: you are trusting a quorum of people you can likely name, which is a very different posture from trusting a corporation's terms of service.

Privacy by blind signatures

Inside the federation, members transact in ecash notes whose blinded signatures hide who is paying whom. When the mint signs a note, the signature is applied to a blinded message, so the guardians cannot later connect the note they signed to the note being redeemed. The consequence is strong: guardians cannot see internal balances, cannot reconstruct who paid whom, and cannot selectively censor payments they cannot even identify. Members get cash-like privacy inside the federation — better, in that dimension, than transparent on-chain transactions — at the cost of the custody trade-off above.

Lightning and scaling

Fedimint federations connect to the wider world through Lightning gateways: a member's wallet can pay any Lightning invoice, with the gateway swapping ecash for an outbound Lightning payment, and receive the same way in reverse. Because everyday payments happen as instant, feeless ecash transfers rather than individual on-chain transactions, a federation also functions as a scaling layer — batching a whole community's activity and touching the base chain only on deposit and withdrawal. For low-value, high-frequency payments, that footprint reduction is substantial: a hundred coffee purchases inside a federation cost the chain nothing, where a hundred on-chain payments would compete for block space at every fee spike. Gateways are also swappable — if one gateway raises fees or misbehaves, members route through another without moving funds.

Where it fits in the sovereign stack

Fedimint occupies a deliberate middle ground between full self-custody and trusting a single custodian, and it is best understood as a tool with a defined blast radius: never put more into a federation than the guardian set could jointly abscond with without ruining relationships you value. For a sovereign Bitcoiner, the sensible pattern is layered — long-term savings in your own cold storage under your own keys, working funds on your own Lightning node, and community-scale spending money in a federation whose guardians you actually know. That layering, not any single tool, is what decentralizes custody in practice. For the underlying cryptographic primitive, see blinded signature; for the single-mint cousin, see Cashu.