Cashu

An ecash note is a short piece of data your wallet stores, not a coin recorded on the blockchain. A developer known as calle published the first implementation, Nutshell, in September 2022, and the protocol is now written down as numbered specifications called NUTs. Everything in a Cashu wallet is a claim on one operator, which places it in the spending money category and nowhere near your savings.

How it works

A Cashu mint signs money it is not permitted to look at.

The trick is a blind signature. Your wallet invents a random secret, mathematically blinds it, and sends the blinded value to the mint together with a Lightning payment. The mint signs what it was handed, having never seen the underlying secret, and your wallet then unblinds the result. What you are left with is a valid signature on a value the mint cannot recognize. The scheme Cashu uses for this is a blind Diffie-Hellman key exchange described by David Wagner in a 1996 cypherpunk mailing list post, itself a descendant of the blind signatures David Chaum published in 1982.

Spending is copying text. A token is a string your wallet exports, and you can hand it over in a chat message, a QR code or an email. The recipient presents it to the mint, which checks that the secret has not been redeemed before and swaps it for fresh notes. The mint sees that a note was spent. It does not see who spent it, who received it, or that the two of you know each other.

Balances are stored in powers of two. A hundred satoshis is held as separate notes of 64, 32 and 4, so the mint knows which denominations exist but keeps no account, no login and no record of your balance. The protocol is deliberately amnesiac.

The cost of all that is plain. The mint holds the actual bitcoin, so it can vanish with the reserve, quietly issue notes it has no backing for, or simply stop answering redemption requests. Notes also live as files on your device, and unlike a seed phrase there is no universal way to recover them from a scrap of paper if the phone goes in the river.

Where you see it

Cashu shows up wherever a payment needs to be small, instant and private, and where the amount at stake is small enough that the operator's honesty is an acceptable bet.

Wallets such as eNuts, Minibits and the browser wallet at cashu.me let you join a mint in seconds with no signup. Nostr picked the idea up for tipping: the NIP-61 specification defines nutzaps, tips that travel as ecash tokens rather than as Lightning invoices. Mints are run by hobbyists, podcasters and small businesses, and any of them can close tomorrow.

The rule worth carrying away is about size. Treat a Cashu balance the way you treat the notes in your pocket: handy, private, replaceable, and capped at an amount you would shrug off. Coins you bought to hold belong behind a seed phrase you control, on hardware if the amount justifies the expense.

Cashu vs a custodial wallet

Cashu and a custodial exchange balance are both somebody else's bitcoin, and the difference is what the custodian knows about you. An exchange records your identity, your balance and every transfer, and in return you get support staff, a legal entity and sometimes a regulator. A Cashu mint knows none of those things and offers none of them either: no account to recover, no ID check, no complaints process, and often no idea who its users are. Privacy from your custodian is real and worth something. It is not the same as not having one.