You can also listen to this blog as an audio:
Or open it with your favourite podcasting app.
The period of free banking in the United States lasted from about 1837 to 1863. During these years, private banks had the freedom to issue their own banknotes without central regulation, resulting in a unique and diverse monetary system. To understand the usefulness and functionality of its parallel in the bitcoin world, let’s first describe it.
At this time the US was on the gold standard, so the money was gold and silver. Banks were allowed to issue their own notes, which were backed by gold or silver stored in their vaults. These notes served as paper gold bills, which meant that the holder could visit the issuing bank at any time and exchange the note for the equivalent value in precious metals. Each bank issued its own unique banknotes, leading to many different notes in circulation.
People preferred them for several reasons:
- Convenience: banknotes were much lighter and easier to carry than physical metals. Imagine carrying a $100 bill versus an equivalent weight of gold – a banknote was more practical.
- Security: some banknotes reduced the risk of theft because they could be stored in the bank under the owner’s identity as deposit products, and sometimes replaced if lost, while the stolen gold was irretrievably gone. Thus, people had part of their deposits in their name and part in the form of banknotes for current consumption.
- Speed of transactions: when using banknotes, there was no need to weigh or verify the purity of the metals for each transaction, which sped up trading. Of course, banknotes could be counterfeited. Banknote authentication was less reliable than gold authentication, but it was faster – just compare the note and security features with the book with note specimen (“bank reporter”). It was even possible to do something like a wire transfer, for example using a cheque.
Image: Authentication of coins by weighing and analysing the metal was made easier by mints, which declared the authenticity of the coins by minting them. Even so, it was still necessary, for example, to verify whether a coin was whole or whether some of the metal had been chipped off – this was done by weighing. To identify the coins, there were coin lists which determined their value in dollars, i.e. linked to the value of the gold – one dollar was exactly 1.5048 grams of gold. For example, 5 thalers was $3.90. The current value of the gold in this coin is $554.18, so the dollar has lost 99.3% of its value in that time. Source: WikiMedia Commons
What did it look like in practice?
James Harper, a merchant from New York, arrived in San Francisco after a long journey by boat to Colón, Panama, riding the Panama Railroad and sailing from Panama City to San Francisco. With a leather bag full of banknotes issued by the Bank of New York, he entered a small but cosy hotel by the harbour. “Hello,” he greeted the clerk, a young man named Robert, and placed a $20 bill on the counter. “I’d like a room for three nights.” Robert glanced at the bill, slid it between his fingers, and frowned. “New York, huh? Wait a minute,” he said, pulling a battered book out of a drawer – Bank Note Reporter. He leafed through it until he found an entry: a note from this bank was discounted 15% in San Francisco because of distance and uncertainty about its backing in gold.
Image: Thompson’s Bank note reporter, 14 April 1849. For New York banks, there is a description of each note, a description of what defects the counterfeit notes have, and at what discount they recommend accepting them because of the risk to the bank. Source: WikiMedia Commons
“We’ll accept it,” Robert continued, “but at a discount. I’ll only credit you $17 for $20. Or you can work it out at the bank on the street corner-they can give you a better rate if they’ll take it.” James shook his head; he didn’t feel like going anywhere else after a few weeks of travel. “Okay, take it that way,” he agreed. Robert nodded, wrote down the transaction and handed James the room key. The hotel accepted the note outright, but the discount reflected the risk-no one was sure the New York bank really had the gold to back it, and shipping it to be verified and settled would take weeks.
Image: James Harper in a hotel paying with a banknote issued at the other side of the country. Will it work?
Later, as James sat at the window watching the bustle of the harbor, he pondered the banking system. Bank notes made his journey easier – he didn’t have to lug around heavy gold coins – but the price of convenience was obvious. The hotel would probably keep the note to settle with the local bank, which would send it back east through the clearing house. James smiled; even with the discount, it was worth it to have a place to sleep. Next time, though, he’d rather take the bank notes from the San Francisco bank – if he ever came back here again.
Real discount values were mostly 0%-5% for notes from local, reliable banks, 5-10% for notes from more distant but still well-known banks, and 10-30% for notes from very distant or less trustworthy banks, especially if their solvency was questionable.
Image: Recommended discounts in Philadelphia. These cover costs such as transportation and risk. Source:WikiMedia Commons
Transporting gold over long distances was expensive and risky. Bank notes, even at a discount, were a cheaper and safer alternative than transporting physical gold and silver.
Bitcoin free banking
Why even think about and use Bitcoin banks when we have the option of owning Bitcoins directly? Let’s take a look at the original historical reasons for free banking and compare the reasons for using banks instead of gold and silver coins with the current reasons for Bitcoin.
Bitcoin is often compared to gold – it is rare, decentralised and its ownership is fully in the hands of the holder via a private key. Unlike physical gold, however, it has no mass or volume, so it would seem that the problems of the past do not constrain it.
Although Bitcoin has no physical weight, its use in everyday transactions can be impractical due to technical requirements and transaction fees. Managing private keys, securing a wallet against hacking or loss, and confirming transactions requires technical expertise and time. For the average person who wants to pay for coffee, this can pose a problem. Transaction fees, however, are a much more fundamental problem.
Let’s imagine the next few years when one Bitcoin reaches a value of $10 million. For a typical transaction of around 200 bytes, we would have to pay at least 200 satoshi, or $20 per transaction. That’s if the Bitcoin blockchain were empty and a 1sat/vB fee would suffice. In reality, the fee could be a hundred times or more higher that that in the future.
Even though Bitcoin is “cash” – it is not a claim of any third party, counterparties would do better to devise a different method of settlement. This could be the Lightning network, for example, which lowers the cost of smaller transactions so that on-chain settlement is not needed for every transaction.
However, the Lightning network is also not free and we are getting down to practical details. It is also difficult to send smaller amounts over the Lightning network. If a coffee would cost 40 satoshi, but enforcing a transaction (channel state) would cost on the order of thousands of satoshi (a commitment transaction in Lightning is larger than a normal payment, and the entire settlement is several transactions), we run into the problem of fees again. In addition, while sending amounts smaller than 1 satoshi (in the model example with a bitcoin price of $10 million, 1 sat is worth 10 cents) over the Lightning protocol is technically possible, enforcing such a transfer is problematic because the smallest unit of account in a cash settlement (i.e., in this case, on-chain) is one satoshi, and an on-chain fee still needs to be paid to make a truly irreversible settlement.
The solution, of course, may be reputation for Lightning channels – if different institutions want to have a channel between them, they agree on the terms of an off-chain settlement, with a possible penalty for closing the channel. Here, using an impartial Bitcoin bank can be an interesting option – after all, the Cashu token can also serve as a Lightning channel. However, for true micropayments, it is better to use some form of electronic cash that is fast, efficient, and doesn’t have the problem of spam overwhelming the network. We will give up some decentralisation, but ideally only in cases where we are not willing to pay the cost of decentralisation – that is, in cases where it does not make economic sense. Sending small amounts, onboarding people with the first Bitcoins, paying for API calls or simple interactions (e.g. paying for AI models per prompt), or offline payments.
How to build free banking on Bitcoin
Free banking in the US used banknotes, some form of clearing between banks and some form of reputation. At the same time, it was relatively easy to start a bank. Banks had a local presence, so they were “closer” to their customers.
Of course, free banking on Bitcoin can look like traditional banking – each bank has its own interface (mobile app, web interface of internet banking), sending money between banks uses different networks, transferring within the bank is instant and cheap (usually almost free). However, we would do much better if we had a protocol for free banking over Bitcoin. This would have several advantages – over the same protocol, people could use different wallets regardless of “bank”, or they could access dozens of “banks” from a single wallet. The protocol also provides some properties (privacy, offline functionality, etc.), so we can expect innovations that build on a building block with known properties. The protocol would also allow for partial decentralization – if we have our 100k sats in 50 banks, we risk much less than if we have all sats in one bank.
Of course, it would be nice if these banks were able to interact with the neutral Bitcoin network (whether through on-chain payments or Lightning).
Let’s break down the basic building blocks and explain them using the example of the Cashu protocol.
Electronic cash
Paper notes had very useful properties in the free banking era. The banknote made it clear which bank held the gold backing it. At the same time, the banknote itself was anonymous, i.e. if we paid someone with a banknote, they could use it without needing to tell the bank about the change of the ownership of the banknote. The transfer of gold was done by giving someone a piece of paper, the bank didn’t even have to know about the transaction. This ensured privacy and low cost – there was no need to go to the bank.
The protocols for electronic banknotes (e-cash) have been around much longer than Bitcoin. Bitcoin’s innovation, therefore, was in the invention of electronic gold – a reserve that is neutral and independent of the issuer. E-cash as a concept originated as early as 1982, when David Chaum published his paper “Blind Signatures for Untraceable Payments”. The system he designed allowed the creation of digital money issued by a central authority (a “mint”) that was anonymous but verifiable.
Chaum’s motivation was clear: in an era when computers and the Internet were becoming a normal part of life, he saw a threat to privacy. Traditional electronic payments, such as credit cards, left a digital footprint – each transaction was linked to the user’s identity. Chaum wanted to create a system that mimicked physical cash: money that you could spend without anyone knowing who it came from or where it was going.
Chaumian e-cash works like this:
- Creating a digital banknote: The user generates a unique number (the serial number of the digital banknote) and “blinds” it using a mathematical operation. This blinded number is sent to the bank (mint).
- The bank’s signature: the bank signs the blinded serial number with its digital signature without knowing what the original number was. It then returns it to the user and debits an equivalent amount from their account (or somehow a payment is made).
- Unblinding: The user removes the blinding factor and thus has a signed e-cash note to spend. The bank will now know it is a genuine e-cash note because, even though it never saw the original “serial number”, it knows that it had signed the note at some point.
- Payment: When paying the merchant, the user hands over this signed note. The merchant sends it to the mint for validation swapping for new e-cash notes. Within this process, the mint checks if it has already been spent (protection against double spending).
The key feature was anonymity: the bank could not link the note to its original owner, but could guarantee that it was genuine and had not been used multiple times. The system thus combined the privacy of cash with the security of digital technology.
How does a blind signature work? Imagine you have an unforgeable “stamp” that says “1 sat”. A person walks into a bank with a piece of paper with a random number on it, the banker closes his eyes and stamps the paper (and debits 1 sat from the person’s account with the bank).
Now this person pays the merchant for the goods with the stamped paper. The merchant comes to the bank with the stamped paper and a new piece of paper with “1 sat” written on it. The banker (mint) checks the validity of the original slip and, when he finds it valid, writes the number on the list of spent slips, closes his eyes again and stamps the merchant’s new slip.
Image: This is what a 1 sat e-cash note could look like. The denomination, i.e. the value of the note, is indicated by the signature key (“stamp”). The random string serves both to indicate that it is something that only the owner of the banknote has (the banker had his eyes closed when stamping the paper), and at the same time, when the banknote is exchanged, it is something that goes into the spentbooks for double-spend prevention.
A bit more detailed description – the bank (mint) has several signing keys (stamps) which it uses to stamp banknotes of different denominations (1 sat, 2 sat, 4 sat, 8 sat, 16 sat, …). Each banknote that is spent is stored in a spent book. Thus, for a note to be valid, two things must apply – it must have a valid signature of one of the keys and it must not be on the spentbook. And in some cases the user must also supply proof of spendability, for example if he locked the e-cash note to a public key, he needs to provide the signature with the corresponding private key. For additional conditions, the traditional Bitcoin script is used (same as for on-chain transactions), making it possible to build Lightning channels on top of Cashu, for example.
Of course, if we want to pay 1 sat and we only have a coin worth 32 sat, the bank provides the option to “change the coin into smaller denomination coins”. When a 32 sat note is spent, it can change it into 2×1 sat, 1×2 sat, 3x4sat, 1x16sat, for example.
What are the characteristics of such a bank? Good features include anonymity – the bank sees the coin for the first time when someone wants to spend it, so it has no idea who it came from. If the user connects through an anonymising network such as Tor, they don’t even know the IP address of the person exchanging it. Banknotes are not linked to each other in any way, so when a bank exchanges a note, the bank has no idea whether the customer is exchanging all of his or her assets or just paying change.
The bank (mint) doesn’t even have a concept of a transaction – there is only an exchange, there is no concept of sender and receiver. At the same time, each exchange or payment is extremely cheap – verifying the signature, adding it to the list of spent notes, and creating a new signature. Unlike blockchains, but also the Lightning network, there is no need for any complex collaboration of multiple entities, one simple database will do.
The advantage for the client is that payment is bearer-based – a token is a simple binary string that can be sent over any communication channel, scanned as a QR code, etc. For payment, the sender doesn’t need to do any complex cryptography if they have enough coins – they basically pick the right amount of coins from a text file and deliver them to the receiver. This operation can occur easily without the Internet, over a slow communication channel.
Thanks to the possibility of adding additional conditions, it is even possible to make a fully offline payment. Imagine you are going to a deserted island. In the tourist guide, you find the public keys of the merchants and prepare coins for each of them in advance with which you can pay. The condition to spend is “either signature with a private key corresponding to the public key of the beach cafe or 14 days have passed since the coin was issued”.
You hand over the coin at the café. The recipient verifies the signature of a bank he trusts and knows that you could not have spent the coin, because without the cafe’s signature it can only be done after the time lock has expired. This way, the café can accept the payment (for example, by scanning the QR code with the coins) without having to connect to the Internet or communicate with the mint at all.
When the owner of the coffee shop sets out from a deserted island to fetch more coffee beans, he can use coins to pay (using his private key) the coffee roaster. If you drank fewer flat whites than you expected, when you return from the deserted island and the time lock expires, you exchange the coins you didn’t spend at the coffee shop for fresh coins with no strings attached.
Backing
Free banking in the US was backed by gold (and silver), Bitcoin freebanking should of course be backed by Bitcoin. However, this is hardly feasible without trust. Of course, Bitcoin reserves are very easy to audit, but as with freebanking, it is quite difficult to prove how many notes a bank has issued, especially if they are anonymous and blinded. It’s not a completely unsolvable problem, but reputation and decentralization will play a role – it’s not a problem to use coins from different banks, even within a single payment, and thus reduce the risk of a fractional reserve bank not surviving a run on the bank. Of course, savings in higher amounts are easiest to hold directly in the underlying asset (on-chain Bitcoin or in the lightning channel).
However, the advantage of linking with Bitcoin is that exchanging an e-cash note for the underlying asset is relatively easy, you just need to pay the miner fees or the lightning network payment fee. Using the underlying asset, “clearing” between banks can also theoretically take place, but this is mostly initiated by the user and not the bank. The bank itself does not accept banknotes from other banks, but it can accept them via the Lightning protocol.
To understand how, let’s describe the two basic functions of each e-cash mint: melt and mint. If I am given an e-cash note, I can instruct the mint to destroy it (put it on the spendbook) and give me the underlying asset by paying the provided Lightning invoice.
Similarly, we can have a coin minted – the e-cash mint will deliver a Lightning invoice in response to the mint command, after paying which we will receive new e-cash notes.
By combining these two functions, we can do “interbank clearing”. If we want e-cash notes of another mint, we can ask the new mint to mint the coins. In response, we get a Lightning invoice, which we deliver along with the existing notes at the “sending mint”. The e-cash notes in one mint will be destroyed, but due to the payment of the Lightning invoice, the other bank will issue us new e-cash notes.
Lightning is thus a neutral clearing network. If banks see that this operation occurs frequently, they can open a direct Lightning channel between themselves and save on routing fees. Both Bitcoin and Lightning will thus become a neutral settlement layer in an electronic free banking system built on Bitcoin.
The discounts on individual bank notes (e-cash notes) do not disappear – like the Bank of New York note in San Francisco, the 1000 sats e-cash coin has a different value in a different “bank”, which involves accessing the underlying asset or transferring it to a different bank. But the advantage is that the transfer within the bank can be virtually free.
Multinut payments
Access to the underlying asset in the form of the Lightning network brings another advantage that freebanking didn’t have – you can use multiple mints’ notes to atomically pay with the underlying. Don’t worry, we’ll unpack this.
James Harper’s grandson Tom decided to follow in his grandfather’s footsteps. Upon arriving in San Francisco, he walked to his hotel and decided to pay for his accommodation in e-cash. The year is 2032 and the world is running on Bitcoin. A night in the hotel costs 1000 satoshi. The front desk would gladly accept a San Francisco Satoshi Union bank note, but Tom doesn’t have one. He does, however, have a 100 satoshi coin from a mint that runs on his uncle’s Raspberry Pi 7 in the basement, a 200 satoshi coin from his favorite Brooklyn coffee shop’s Cashu mint that he received as a change, and a 750 satoshi coin from the bank run by the forest kindergarten to which he supplies unpasteurized milk. Tom’s wallet retrieves a Lightning request from the San Francisco Satoshi Union for 1030 satoshi, and his wallet creates a multinut payment, which all three mints cooperate to pay. Lightning payment fees amount to 20 sats along the way.
Image: Tom Harper pays with e-cash notes using his smartphone
Of the 1030 e-cash notes, he sends a 1000 sat coin to the hotel and has 30 sat coins left over to pay for a hipster flat white at the café across the street, which also takes San Francisco Satoshi Union e-cash coins.
There is a minimum charge of 15 sats on the Lightning network against spam, so Tom is glad he didn’t have to pay for his coffee with another Lightning payment, it would have made his coffee way too expensive.
Multinut payments are experimental and are only now coming to wallets and mints based on the NUT-15 standard. You can try them with nutshell or minibits for example.
Many recipients at once? No problem
If you wanted to send a few sats to many (say 100) recipients at once – for example, all the developers of an application – this would be a problem. With on-chain Bitcoin, this would be a problem because of transaction fees – amounts below the dust limit cannot even be accepted, the fee for moving them to another address is higher than their value.
For Lightning, we would need to get 100 invoices, create a path to each one, and pay it. They should all be online and have a reachable payment path.
However, if we have a way to send any string to them – for example, over the Nostr network, we can break 100sat e-cash into tokens of 1sat each and send the strings to each of them over the Nostr relay.
When the recipients connect online, they read the message and exchange the e-cash note for a new one that will be theirs alone. They don’t have to be online at the time of the sending of the transaction.
They can claim the sats over Lightning whenever they want (possibly after batching multiple e-cash tokens), or just use the e-cash tokens for purchases.
Alternative tokens – fiat currencies
Support for other tokens can be useful if you want to use a different unit of account (for example, dollars), but want to use the free banking system over Bitcoin. You can still use Lightning for “interbank settlement”, but you can think (and stay) in dollars, euros or guaranis, your wallet can display balance in those currencies too. One example of a dollar cashu bank/wallet is Boardwalk Cash. It’s connected to stablenuts mint, where it’s possible to have a dollar balance.
Image: Boardwalk Cash wallet allows e-cash balances in both USD and BTC. I accepted two dollar cents into this wallet by paying the Lightning invoice as if it were any other Cashu wallet. I can now send the dollars as ecash or I can pay a Lightning invoice.
You can receive these dollars by scanning an animated QR code or by inserting the ecash token into your wallet:
cashuBo2FteBxodHRwczovL3N0YWJsZW51dC51bWludC5jYXNoYXVjdXNkYXSBomFpSAD2hOihuoaWYXCBo2FhAWFzeEBkZGVjZmRiYzdjYzc4YWJYTQyMjllNWQzMGQ1MjFlY2EyY2E1NzQ1NjQ4M2IzNzVhYWM4MzRlMjliZjNkZDU2YWNYIQJsOyI87xWG_a06bhcDug44npZILrHaZfZDPKGo0vpmQA
This e-cash token is directly the electronic cash, if you put it in a wallet that supports dollars, it will request the bank (mint) to swap it for a new one. So this token will only work for the first one of you that claims it.
Unlike on-chain and Lightning Bitcoin payments, where only links to addresses, invoices or lnurl are sent, in this case, the e-cash is directly this note – you don’t need anything extra, the e-cash note is valid until someone exchanges it for a new one.
By the way, it is theoretically possible to provide other services such as futures or Bitcoin-backed loans this way. But these additional services have to be programmed by Bitcoin banks. However, they can still use the same protocol.
Event tickets
A very good use of ecash technology is ticketing for various events. This is a form of “NFT”, where there can also be seating and the like.
Why bother with e-cash for ticketing?
Imagine getting a PDF ticket with a QR code that you can use to enter a music festival. You’d also like to buy a campervan ticket, but that’s sold out, so you check the Vexl app to see if anyone is selling it. You’ll find a seller who unfortunately for them, but fortunately for you can’t make it to the festival. But how do you verify that the ticket is genuine? And how do you ensure that the same vendor hasn’t sold the same ticket multiple times?
Mind you that you can’t rely on reputation, if the market is permissionless and anonymous, there has to be some other way.
Image: Tom Harper’s son Neo in 2050 arrives at a concert with a ticket in the form of an e-cash token.
If the ticket was a bearer e-cash note, you could import it into your Cashu wallet, which would automatically ask the mint to invalidate the original ticket and sign (using a blind signature) the new coin. When you enter, you simply present the new ticket, which is valid, and you know for sure that no one else could have used that ticket (because only you have the new one).
If the original seller tries to sell the ticket to someone else, it will not be imported to the new customer because it is already in the spentbook.
Cashu token as a postage stamp
The design of the Internet, and e-mail in particular, is buggy. The Internet originated as a military and academic network. Nobel Prize-winning economist Paul Krugman predicted that the impact of the Internet on the commercial sector would be no greater than that of the fax machine. His other predictions, including those about Bitcoin, are probably of similar “quality”. We should have listened to David Bowie, who saw the Internet as a new world in which everyone would be – and he was right, even without Nobel prize.
Of course, this also poses a problem – if our attention is easily attainable for practically free, for example by email, commercial entities will seek to gain it and begin to monetize said attention. Internet spam appeared earlier than the explosion of e-commerce and dotcom bubble. Spammers were monetizing our attention sooner than regular business entities.
As with free banking, we’ll use a real-world analogy to help us. How is it possible that a Nigerian prince doesn’t write letters to our snail-mail-box? The answer is simple – the cost of delivering the letters is much higher compared to the weighted successful conversion to income and hence this business plan does not pay off for the fake Nigerian princes. But why do we get supermarket catalogues in our mailboxes from supermarkets in the vicinity? This advertising is relevant and profitable for the “spammers” despite the cost.
Note that the cost of delivery is paid by the sender – the supermarket catalogue needs to be printed and distributed to physical mailboxes. But we, as the recipient, get paid nothing. This is the idea that Adam Back turned into a digital form when he came up with the Hashcash protocol and the Proof of Work principle, which we also use in Bitcoin. Hashcash is an “artificial” cost to the sender, much like Bitcoin mining is. The sender effectively “mines” with a pre-determined difficulty, and the receiver can choose what cost the sender must incur for the email to arrive.
Unfortunately, the Hashcash protocol has not been successful – it would probably only have been adopted if it had been deployed from the beginning of e-mail. Moving from a free service to a service with a cost is quite difficult and goes directly against the network effect of email.
The solution that won in the case of email is the reputation of the sending server (“not blacklisted”), content scanning (“does the Nigerian prince need help with his inheritance?”) and, more recently, smarter filters and digital signatures.
However, this does not preclude the exploration of new possibilities. The keychat service uses the Nostr protocol in conjunction with Cashu micropayments for messages. Unlike Proof of Work, which is just a proof of cost, Cashu tokens are directly micropayments for the use of the infrastructure. So the cost of sending a million messages is quite high and if someone wanted to pay for it, it would help pay the bills for running the servers.
Cashu e-cash token is very fitting solution in this case, because similarly to the Hashcash protocol, the “payment” can be inserted directly into the header of the email (message) and no further communication is required (in the case of lightning payment, more than a dozen messages are exchanged, so interactive communication is required).
In this case, the Cashu token can be considered as a “postage stamp”. The server (or receiver) exchanges it for a new one at the mint when it sees fit and, if successful, delivers the message.
This method of micropayment is also suitable in other cases. We already mentioned Zaps on Nostr, another useful use case is paying for API calls. For example, if you need AI to generate an image or answer a prompt using a large language model, you can do so without having prepaid credits or paying a monthly fee. You simply attach a Cashu token to the request to pay for the API call – no need for an account either.
In practice, we can use this, for example, in the Athenut service. This uses the Kagi search engine API, which works not on the basis of ads, but on payments from customers. The fact that a privacy-focused search engine requires the creation of an account struck the developer “thesimplekid” as odd, so he created a front-end to the search engine that has an integrated Cashu mint. You can buy the tokens used for searches by Lightning. The service has a Cashu wallet integrated in the JavaScript of the page and stores e-cash notes in local storage. And it spends one e-cash token on each search request.
Other ways to fight spam
For completeness – creating costs or payments or reputation are not the only ways to successfully fight spam. We see this, for example, in the fact that people are increasingly using social networks or messaging apps such as WhatsApp or Signal to communicate. In some countries, to such an extent that you do not even get a reply to an email, even from an institution like a bank, but you do get a reply on WhatsApp.
These services also have to fight spam to some extent, but in the case of centralized solutions this is easier – and in the case of WhatsApp and Signal, the cost is at least a phone number to which you can limit the number of messages sent. Other services use sophisticated cryptography (time-delay functions or rate limit nullifiers), but for example SimpleX has found a much simpler solution – it has no persistent identifier. If you want to write to someone, you have to get their contact details, either by scanning a QR code or by delivering a contact string, which can be a one-off. And you can cancel each contact string without losing existing conversations.
To learn more about (encrypted) messaging, read Encrypted messengers – how to communicate privately? and Encrypted messengers – comparison
Wallets
Because Cashu is a protocol and not a specific service, we have several wallets available. These differ in technical details (the language they are written in, the technologies they use), user interface and philosophy. Since the Cashu protocol is extremely simple, this is an opportunity for anyone to create a wallet or other form of software and experiment.
Several experiments are underway. Firstly, experiments are being conducted with the form of the wallet. In addition to the traditional Android (Minibits) and iOS (Macadamia) apps, there are also command-line versions like nutshell. However, progressive web apps that don’t need any store like the App Store or Play Store will be particularly interesting. The most well-known web-based Cashu wallets are Cashu.me, the aforementioned BoardWalk Cash, and Nutstash.
Video: Demonstration of how to use the Android Cashu wallet called Minibits
Another advantage of web wallets is the extremely fast onboarding of users. You practically just need to send them a link and their first Cashu wallet can be opened – usually with their first Bitcoins. So you can turn a nocoiner into a Bitcoiner in one click. Of course, it’s a good idea to back up your Bitcoins (in the form of Cashu notes in this case). This is done with a traditional seed backup. From the user’s point of view, it’s similar to any other seed backup (you need to write down 12 words), but in practice the backup works a bit differently – it’s accessing signed ecash tokens and restoring the backup is a bit privacy-intrusive. Therefore, it’s a good idea to restore the backup only when absolutely necessary, and in case of a wallet migration, it’s better to create a new one and forward the ecash tokens.
All Cashu wallets also function as Lightning wallets – you can accept Lightning payments and pay merchants over Lightning. Cashu wallets are one of the best ways to show people Bitcoin without immediately disappointing them with fees. Of course, it’s still the case that higher amounts should end up in a hardware wallet and medium amounts in a non-custodial Lightning wallet such as Phoenix, Breez, or Zeus.
Not your keys, not your Bitcoin
The classic Bitcoiner mantra is “not your keys, not your Bitcoin” still applies. But using the keys also has a price, which we don’t know ahead of time, until we try to use them – for one thing, we don’t know the price of Bitcoin (although in this article we use a conservative estimate of $10 million per Bitcoin and thus 1 sat = 10 dollar cents:). In addition, we don’t know how full the blocks will be in the future.
So we need to use other technology for onboarding, pocket money for children, etc., so that the use of Bitcoins also makes economic sense. In countries where a dollar (which on-chain transactions normally cost even now) is a lot of money, and people won’t use on-chain wallets and will rather switch to custodial solutions. Similarly with Lightning – neither opening channels nor using them is free.
If we are willing to bear some form of risk, we can use a fully custodial solution such as the popular Wallet of Satoshi or Bitlifi wallets. The disadvantage of these wallets, however, is that the custodian is directly the author of the wallet – we cannot spread the custodial risk to many institutions. For example, if we opt for Wallet of Satoshi and someone has Bitilifi, the transfer already goes through Lightning and there are fees associated with that. These aren’t high yet, but why couldn’t we have a balance with both providers? Of course, we can install both custodial wallets and pay according to who we send satoshi to. It’s just that we may not know that from the invoice, and besides, managing and updating multiple wallets is difficult. What if there are 50 of them?
In this case, Cashu simplifies custodial use – we can have one wallet where we have balances with multiple custodians (“banks”, mints). We can even very easily become such a custodian and provide access to the bitcoin payment network to, for example, our family. If we give our children pocket money in Bitcoins, for example, it makes no sense to pay fees or open special channels for them. Handing over ecash tokens will serve the same purpose. As parents, we give our children a great deal of sovereignty; for example, we have no idea how much of those Bitcoins they have put away and how much they have already spent.
But our children can also interact with their classmates and trade with each other. If each family runs its own “bank” (mint), classmates at school can trade with each other seamlessly, also at no cost, if they trust their classmates’ parents’ e-cash notes to some extent. If they don’t trust them, they can convert them into their family’s e-cash notes, with a small fee for the Lightning payment.
Cashu is not the second layer of Bitcoin (or even the third), the pseudonymous author of the Cashu protocol Calle correctly says that the layer must support a sovereign transition to a lower layer in order to qualify for being another layer. The latter does not have to be free of fees, but it must be free of third-party permission. Cashu doesn’t have this feature, and it’s good to know about it – if a mint shuts down its service or refuses to pay a Lightning invoice based on tokens for whatever reason, the user has no way to leave this “pseudo layer” without the mint’s cooperation. Therefore, the analogy with free banking is much better than calling it a Bitcoin layer. However, this does not mean that Cashu has no place – an example is the family, where rugpulls need not be feared. Usually.
Bitcoin Lightning as the basis of bitcoin freebanking
Now let’s get back to why Cashu is a Bitcoin project in the first place. If we can have a dollar balance on a mint or even a ticket to a concert, it would seem that “backed by Bitcoin” is just an empty phrase. Of course, we can’t verify the backing and should look at the reputation of each mint. But here comes an interesting twist – the fact that even dollar coins (or concert tickets) can be exchanged for sats means the unit of account for such freebanking is satoshi. If you want to buy (create an e-cash worth) $100 on a Cashu mint that supports dollars, you will get a quote denominated in sats. You pay the Lightning invoice and you have bought a dollar e-cash note.
Figure: The process of exchanging dollar tokens for a concert ticket. Mints communicate with each other over the Lightning network, and all prices are denominated in sats (including what $100 is worth!).
Note that the creation of coins, their use (melt) or exchange is based on prices denominated in sats via the Lightning network. Want to buy a ticket for a hundred dollars? The ticket seller will tell you how many sats they want for it, your dollar ecash mint will tell you how many dollar tokens you need to pay the sats for the ticket, and the whole thing goes through Lightning, in which sats are the unit of account.
In Cashu-based freebanking, the backbone of intermint communication (inter-bank clearing) is Lightning and the sats are unit of account – the unit in which all prices are listed.
This is unlike the traditional economy where prices are listed in fiat currencies. Even on Bitcoin exchanges, you are shown how many dollars one Bitcoin is worth, how many dollars one Monero is worth, etc. In Cashu-based free banking a “dollar” token has price in sats – that’s the only currency that works here, as a medium of exchange and as a unit of account.
Fedimint – an alternative to Cashu
We should not forget about the second implementation of Chaumian e-cash systems – Fedimint, with their flagship superapp Fedi. Fedimint works on a very similar principle to Cashu, but the bitcoin backing is guarded by a federation (using multisig on-chain Bitcoin). This makes potential rugpulls more difficult. If Bitcoins are protected by a multisig and you can communicate with a subset of mints in order to swap tokens, there is much less likelihood of an outage, a successful run on the bank (if it doesn’t have full backing), and so on. Fedimint, on the other hand, is a more closed system with far fewer implementations of both mints and wallets. And the common use-case is you are a member of one Fedi mint, multimint use-case is not as developed. The simplicity of Cashu is an advantage for the diversity of the ecosystem.
Video: Fedi e-cash wallet user interface
For Cashu, it is recommended to use multiple custodians (banks, mints), whereas Fedi counts on communities that will mostly use the same custodian. They reduce its risk precisely by distributing responsibility among multiple trusted actors. For Fedi, however, most of the things we’ve gone over here apply, and if this protocol would win the competition for Bitcoin freebanking e-cash protocol, nothing terrible would happen. Multiple options is Bitcoin’s advantage – I would even say superpower.
Payments over low throughput communication channels
Lightning payments are communication intensive, creating a path and creating commitment transactions is quite a few messages both ways. Of course, some of this communication can be “outsourced” to the wallet provider (that’s how Phoenix works, for example), where the path finding and creation is done by the server. Even so, a commitment transaction needs to be negotiated between the wallet provider and the wallet, and a new one needs to be created with a settlement once the payment is successfully settled. This is of course seamless over a high-speed internet connection, but what about when we are communicating with QR codes, or over a slow radio?
A QR code with an e-cash token is admittedly “bigger” than a Lightning invoice, as it often contains multiple coins of different denominations for a specific amount. On the other hand, that’s all that’s needed for a payment (or the recipient could exchange the token, which is two messages – an exchange request and a blind signature).
This allows us to use Cashu, for example, over a super post-apocalyptic network like Reticulum, or over Waver and analogue radios, or whatever.
Video: Demonstration of the Nutband project, thanks to which you can exchange a coin in the Cashu project for a new one and thus successfully accept a payment
Video: Sending a cashu token over audio – no camera needed. This can travel even through analog walkie-talkies!
Of course, custodial Lightning wallets such as the Wallet of Satoshi allow you to pay with less data requirements, since all the money is stored with the custodian. With cashu wallets, it’s similar – you can use them as Lightning wallets with multiple “custodians” and pay Lightning invoices with them, and this payment will be made via the server and thus less data-intensive. Additionally, you can have a Cashu mint on a local community “island” network, accessible via Wifi, or Ha-low, or LoRA networks (such as with the aforementioned Reticulum). Thus, you can create island economies that can interact with the larger Bitcoin network when needed, but can also function autonomously in the case of isolated local communication.
Conclusion
The nice thing about Bitcoin is that it’s an open internet financial reserve protocol (among other things). And that it allows for different forms of innovation. If you’re getting lost in the various protocols, wallets, and ownership methods, you’re not alone. But this complexity is also Bitcoin’s biggest strength and allows for continuous tsunami of innovation.
Cashu gives a boost to the old idea of free banking, which was tried in the US in the 19th century. And while you’ll want to own private keys for most things, at least for now (whether from Lightning channels or directly from on-chain Bitcoin), e-cash also has features that make it worth considering. It has better privacy than on-chain payments, much lower fees than Lightning or on-chain, is faster, and allows a different way of sending Bitcoins – via e-cash notes and thus electronic bearer cash, not transfers.