Cashu

Cashu is a free and open-source Chaumian ecash protocol for Bitcoin. A user pays a Lightning invoice to a "mint," which issues ecash tokens of equivalent value; those tokens can then be sent, received, and stored privately, and later redeemed back to Lightning or on-chain bitcoin. Because the protocol is open, anyone can run a mint and wallets from different developers interoperate.

How the protocol works

Cashu is built on a blinded signature scheme based on David Wagner's variant of Chaumian blinding. The wallet blinds a secret before the mint signs it, then unblinds the result. The mint therefore cannot tell which token it signed, who holds it, or when it will be spent — it only verifies that a presented token carries a valid signature and has not already been redeemed, preventing double-spends without seeing balances.

Specifications and trust model

The protocol is defined by a set of specifications called NUTs (Notation, Usage, and Terminology), which keep wallets and mints compatible. Cashu mints are typically single-operator, so users place custodial trust in one party for the bitcoin backing their tokens; this favors small, fast, private payments over large or long-term holdings. Security researchers have publicly disclosed and helped patch protocol vulnerabilities over time, reflecting an actively maturing standard.

Cashu and the federated Fedimint design are the two most prominent Bitcoin ecash systems. Both complement on-chain privacy tools such as CoinJoin by moving private spending off the public ledger entirely.