Ecash and Chaumian Mints

Ecash brings David Chaum’s blind-signature scheme to Bitcoin. A mint signs tokens without seeing their serial numbers, so it cannot link a token’s issuance to its later spending. Users deposit bitcoin, receive blind-signed ecash tokens, and spend them with strong privacy — at the cost of trusting the mint to honor redemptions. Ecash buys privacy by surrendering self-custody.

How It Works

The cryptographic core is Chaum’s 1982 blind signature: a user creates a token, mathematically blinds it, has the mint sign the blinded form, then unblinds it. The mint’s signature is valid, but the mint never saw the unblinded token and so cannot connect the deposit (issuance) to the eventual spend (redemption). Applied to Bitcoin, the user deposits BTC with the mint, receives blind-signed tokens, and transacts in those tokens privately; the mint sees deposits and withdrawals but cannot map one to the other.

This is the same Chaumian machinery that powered DigiCash in the 1990s — with the same structural catch.

Two Trust Models

• Cashu uses single-operator mints. One operator runs the mint; users accept trust in that operator in exchange for simple setup and operation. Different Cashu mints experiment with different interfaces and integrations, and a user can spread risk across several small mints.
• Fedimint uses federated custody. Multiple guardians jointly control the deposited bitcoin through threshold signatures, so no single guardian can steal funds — a threshold must cooperate. This distributes the trust that Cashu concentrates in one operator, reducing single-point-of-failure risk while still falling short of self-custody.

The Custody Tradeoff

Ecash improves transaction privacy but reintroduces custody risk, which is exactly what Szabo’s argument that trusted third parties are security holes warns about. The hierarchy of trust across Bitcoin’s privacy options is explicit in Hillebrand’s account:

• Base-layer Bitcoin is non-custodial but transparent (see CoinJoin and PayJoin for on-chain privacy).
• Lightning (Lightning Network) preserves unilateral exit: a user can always reclaim funds on-chain without counterparty cooperation.
• Ecash offers no such guarantee. If the mint goes offline, the deposited bitcoin cannot be redeemed. Ecash is therefore a money substitute — a claim on someone else’s bitcoin — not a layer of Bitcoin itself, echoing the money-proper-versus-money-substitute distinction central to hard money and 100% reserve banking.

Federation softens but does not remove the risk: users trade trusting one operator for trusting that a threshold of guardians will not collude — weaker than a single operator, stronger than the trustlessness of self-custody. Ecash is thus best understood as a deliberate, scoped privacy-for-custody trade, useful for small balances and everyday spending rather than savings.

Cypherpunk prehistory: Finney, 1994

The custody question is not new to ecash; it was visible to the cypherpunks who first imagined it. In Hal Finney’s 1994 note to the cypherpunks list, The Beauty of eCash — written about the Chaumian “Magic Money” implementation — he drew the exact historical parallel that the custody tradeoff above formalizes: bank-issued private money is only as good as the issuing bank.

Unfortunately, capitalism is a dynamic system and in those days bank failures were no more unusual than corporate failures are today. When this happened, the bank’s notes became worthless.

— Hal Finney, “The Beauty of eCash” (1994)

Finney was describing pre-1861 American private banknotes, then speculating “that digital cash might lead to an electronic system with some similarities to those old days.” That is the ecash custody risk seen thirty years early: a blind-signed token is a claim on an issuer, and issuers fail. The bulk of his note is a playful proposal to make a banknote’s validity visible as beauty (seeding cellular automata and fractals from the cash, so only correctly-signed notes render a pretty pattern) — an early gesture at the cypherpunk instinct to bind cryptographic truth to something a human can see.

See Also

• Blind Signatures for Untraceable Payments - Chaum’s 1982 primitive that ecash mints implement
• CoinJoin and PayJoin - the non-custodial on-chain privacy alternative
• Lightning Network - the layer that preserves unilateral exit, unlike ecash
• Trusted Third Parties as Security Holes - the custody risk ecash reintroduces
• Hard Money - money proper versus money substitute, the category ecash falls into
• 100% Reserve Banking - the warehouse-receipt/reserve question ecash mints face
• Lessons from Digital-Cash History - DigiCash applied the same Chaumian scheme and failed on the custody point
• Privacy and Cryptography - the implementation-map topic
• The Praxeology of Privacy - ch. 15 §15.10 is the source for this concept
• David Chaum - Cryptographer who invented blind signatures and the untraceable-payments program — the pre-cypherpunk foundation whose ecash and DigiCash ancestored later digital cash.
• Bitcoin - Peer-to-peer electronic cash secured by proof-of-work, with a fixed 21-million-coin supply that makes it the first verifiably scarce digital good.
• Your Secret Right to Cash - Van Valkenburgh’s 2017 essay: cash silently guaranteed uncensorable, private payment — a ‘secret right’ nobody defended because physics enforced it, until electronic money removed it.

Sources

• The Praxeology of Privacy - Hillebrand’s ch. 15 §15.10 on Chaumian ecash applied to Bitcoin, Cashu single-operator mints, Fedimint federated custody, and the privacy-versus-custody tradeoff
• The Beauty of eCash - Hal Finney’s 1994 cypherpunks-list note: the Magic Money implementation, the pre-1861 private-banknote parallel, and the issuer-failure (custody) risk