Cashu

What Is Cashu?

Cashu is an open protocol for ecash on Bitcoin, created by pseudonymous developer Calle and released in October 2022. It implements David Chaum's 1983 blind signature scheme to produce digital cash tokens that are private, instant to transfer, and free to move between users within the same mint. The protocol is MIT-licensed with no company, token, or treasury behind it.

The system works through custodial servers called mints. A user deposits Bitcoin (typically via the Lightning Network) and receives ecash tokens in return. These tokens are bearer assets: whoever holds the token string controls the value. Tokens can be transferred peer-to-peer through any communication channel (messaging apps, QR codes, NFC, email) without the mint's involvement. When a recipient wants Bitcoin back, they redeem the tokens at the mint.

Cashu's core innovation is that the blind signature mechanism makes it cryptographically impossible for the mint to link a deposit to a redemption. The mint knows it issued a valid token and that a valid token was redeemed, but it cannot determine whether those were the same token or connect either event to a specific user.

How It Works

Cashu uses a cryptographic technique called Blind Diffie-Hellman Key Exchange (BDHKE) on the secp256k1 elliptic curve. This is a variant of David Chaum's original blind signature construction. The protocol has three core operations: minting, melting, and swapping.

Minting: Bitcoin to Ecash

When a user wants ecash tokens, they deposit Bitcoin into the mint:

1. The user requests a Lightning invoice from the mint for a given amount
2. The user pays the invoice, sending Bitcoin to the mint
3. The user generates a random secret and computes a curve point from it, then blinds this point with a random factor before sending it to the mint
4. The mint signs the blinded point with its private key and returns the blind signature
5. The user removes the blinding factor to obtain a valid, unblinded signature: the ecash token

Melting: Ecash to Bitcoin

Redeeming tokens for Bitcoin reverses the process:

1. The user presents a Lightning invoice they want the mint to pay
2. The user sends ecash tokens (proofs) to the mint
3. The mint verifies each token's signature and checks it has not been spent before
4. The mint marks the tokens as spent and pays the Lightning invoice

Swapping: Breaking Linkability

Users can swap existing tokens for new ones of equal value at any time. The user sends old proofs along with new blinded messages. The mint verifies and retires the old tokens, then signs and returns new ones. This breaks any potential chain of linkability if a token has passed through multiple hands.

The Blind Signature Mechanism

The privacy guarantee comes from the blinding step. Here is a simplified view of the cryptographic flow:

# Mint setup
k = private key
K = k * G  (public key, published)

# User generates token
x = random secret
Y = hash_to_curve(x)
r = random blinding factor
B_ = Y + r * G          # blinded message sent to mint

# Mint signs (cannot see Y)
C_ = k * B_             # blind signature returned to user

# User unblinds
C = C_ - r * K          # C = k * Y (valid signature on Y)

# Redemption: user presents (x, C)
# Mint verifies: k * hash_to_curve(x) == C
# Mint cannot link C back to B_ it originally signed

The mint uses separate signing keys for each power-of-2 denomination (1, 2, 4, 8, 16, 32, 64 sats, and so on). A payment of 13 sats consists of tokens worth 8 + 4 + 1. This denomination system prevents the mint from using token amounts as a fingerprinting vector.

Token Format

Cashu tokens are serialized as compact strings prefixed with cashuB (the current V4 format), followed by CBOR-encoded binary data in base64url encoding. Each token contains the mint URL, a unit identifier (e.g., "sat"), and an array of proofs. Each proof includes the amount, keyset ID, secret, and unblinded signature point. The V4 format is approximately 40% smaller than the older V3 cashuA JSON-based format.

cashuBpGF0gaNhaUgArSaMTBjGvmFhZQBhc3hAOTk...

Tokens are portable: they can be copied, pasted, embedded in QR codes, transmitted via NFC, or sent through any messaging channel. A token is only valid at the specific mint that issued it.

NUT Specifications

The Cashu protocol is defined through modular specifications called NUTs (Notation, Usage, and Terminology), similar to Bitcoin's BIPs or Lightning's BOLT specs. Wallets and mints must implement mandatory NUTs and can optionally support others.

NUT-12 is particularly noteworthy: it enables offline token verification using Discrete Log Equality (DLEQ) proofs. When transferring tokens, the sender can include the blinding factor and a DLEQ proof, allowing the recipient to verify the mint's honest signing without contacting it.

Cashu vs. Fedimint

Both Cashu and Fedimint implement Chaumian ecash on Bitcoin, but they differ fundamentally in their trust model.

Cashu prioritizes simplicity and ease of deployment. A single developer can spin up a mint in minutes. Fedimint prioritizes distributed trust at the cost of coordination complexity. For a deeper comparison, see the research article on Chaumian ecash mints on Bitcoin and the Fedimint deep dive.

Privacy Compared to On-Chain Solutions

Cashu provides a fundamentally different privacy model than on-chain Bitcoin privacy techniques like CoinJoin or PayJoin.

Cashu provides stronger transactional privacy (the mint has no user accounts and records no transaction history) at the cost of custodial risk. CoinJoin preserves self-custody but leaves all transactions on the public ledger. For a broader view of Bitcoin privacy tools, see the research on the Bitcoin privacy landscape.

Wallet Implementations and Ecosystem

The Cashu ecosystem includes multiple wallet implementations and development libraries:

• Cashu.me: the reference web wallet with multi-mint support, NFC tap-to-pay, and multi-mint payment routing
• Minibits: a mobile wallet for iOS and Android with offline payment capabilities and Nostr integration
• eNuts: a mobile-first wallet rebuilt on the coco TypeScript library
• Nutstash: a web wallet supporting multi-mint payments from a single Lightning invoice

On the development side, the Cashu Dev Kit (CDK) provides a Rust core library with bindings for Swift, Kotlin, Go, Flutter, and Python. The reference implementation, Nutshell, is written in Python and serves as both a wallet and mint. Eight total implementations exist across Python, Rust, TypeScript, and Kotlin.

Lightning Network Integration

Cashu mints bridge ecash and the Lightning Network. Deposits arrive via Lightning invoices, and withdrawals pay Lightning invoices. This means any Cashu user can send to or receive from any Lightning-connected wallet or service.

Cross-mint payments also route over Lightning. If Alice holds tokens at Mint A and wants to pay Bob at Mint B, Alice melts her tokens at Mint A (which pays a Lightning invoice generated by Mint B), and Bob receives fresh tokens at Mint B. Recent protocol work has introduced multinut payments, where a single Lightning invoice can be paid using balances from multiple mints simultaneously.

Several wallets also support Nostr Wallet Connect (NIP-47), allowing Nostr clients to trigger ecash payments directly. Zeus wallet has added alpha Cashu support, letting users receive ecash without opening a Lightning channel.

Use Cases

• Private micropayments: tips, donations, and small transfers where privacy matters and on-chain fees are impractical
• Instant offline transfers: tokens can be handed off without internet connectivity, with the recipient redeeming or swapping them later
• Community currencies: local groups or online communities can run a mint to issue ecash backed by pooled Bitcoin
• Application integration: developers embed ecash into apps (games, social media, content platforms) using wallet SDKs for seamless in-app payments
• Conditional payments: NUT-11 (Pay-to-Pubkey) and NUT-14 (HTLCs) enable tokens locked to specific recipients or conditional on hash preimage revelation, supporting escrow and atomic swap patterns
• Mining payouts: projects like Hashpool are integrating ecash tokens into the Stratum V2 mining protocol as bearer instruments for mining shares

Trust Model and Risks

Custodial Trust

Cashu's primary risk is that users must trust the mint operator. The mint holds all backing Bitcoin and could:

• Drain reserves and disappear (rug pull)
• Secretly issue unbacked tokens (fractional reserve), debasing the ecash supply without users knowing
• Selectively refuse to redeem valid tokens (censorship)
• Go offline permanently, making all issued tokens worthless

The recommended mitigation is to keep only small, spendable amounts in any single mint, spread balances across multiple mints, and prefer mints run by trusted individuals or communities. The ecosystem is developing proof-of-liabilities schemes for auditable reserves.

Double-Spend Prevention

Because tokens are bearer instruments, a sender could attempt to spend the same token twice: once to a recipient and once back to the mint. The recipient should always swap received tokens for fresh ones immediately. If the recipient delays, the sender could redeem first. The mint prevents double-spending by tracking spent secrets, but the race condition window is a practical consideration.

Metadata Leakage

While the blind signature scheme prevents the mint from linking deposits to redemptions, the mint can still observe IP addresses, timing patterns, and aggregate minting and melting volumes. Running wallet connections through Tor mitigates IP-based tracking but does not eliminate all metadata channels.

No Self-Custody

Unlike on-chain Bitcoin or self-custodial Lightning wallets, Cashu tokens represent claims on a custodian. If the mint disappears, tokens become worthless. This makes Cashu unsuitable for long-term savings or large balances. The Cashu vision acknowledges this tradeoff: the protocol is designed for "an ecosystem of large numbers of very small mints running locally, all interconnected over the Lightning Network" rather than a few large centralized custodians.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.