How Ecash Lets You Deposit Money Without Depositing Your Privacy

Most people start on Lightning with a custodial wallet. No channels, no liquidity to worry about, so it is a reasonable choice. But the moment you deposit, you have an account, and where there is an account there is a ledger. The operator can record when you paid, how much, and against which invoice. In exchange for convenience, you deposited your privacy along with your money.

Ecash rewrites those terms. It uses cryptography to make it impossible for the party holding your money to build that ledger in the first place. The custodian knows how much it holds in total, but not whose money it is or who paid whom. A bank, but a bank without accounts.

An Answer That Existed Forty-Four Years Ago

The idea predates Bitcoin by a generation. In his 1982 paper "Blind Signatures for Untraceable Payments", the cryptographer David Chaum proposed the blind signature. The analogy comes from the paper itself. Put a document in an envelope lined with carbon paper and hand it over: the signer can sign the outside of the envelope, and the signature presses through onto the document inside. The envelope was never opened, so the signer does not know what was signed. Yet when the document later comes back, the signer can verify the signature is genuinely theirs.

Chaum built a company on this. DigiCash, founded in 1989, made digital cash that banks would issue and redeem, and in 1995 Mark Twain Bank of St. Louis became the first to adopt it. In 1998, DigiCash went bankrupt. The design depended on existing banks for issuance and redemption, and banks had no particular reason to make their customers anonymous. It also did not help that e-commerce itself was barely learning to walk.

Looking back, Chaum was missing two things: a reserve asset that exists without a bank's permission, and a settlement network that moves value between custodians instantly. Bitcoin built the first, Lightning the second. Ecash reappearing in the 2020s is not a coincidence; the missing foundations had finally been laid.

The Signature Inside the Envelope

Two implementations define Bitcoin ecash today: Cashu, started in 2022 by a developer writing under the name calle, and Fedimint, started by elsirion. The issuer is called a mint. Let us start with Cashu, where there is a single mint, to see the mechanism. The protocol specifications are published as documents called NUTs.

Cashu's signature is not Chaum's original construction. That one was built on RSA and locked up by a patent. In 1996 the cryptographer David Wagner proposed a variant that sidesteps the patent by building the same property on the Diffie-Hellman problem, and Cashu implements it on secp256k1, the curve Bitcoin already uses. With the mint's private key k and public key K = kG, a token is created in four lines.

wallet: picks a secret x and computes the curve point Y = hash_to_curve(x)
wallet: sends B_ = Y + rG to the mint        (blinded with random r)
mint:   returns C_ = kB_                     (signs without seeing the contents)
wallet: computes C = C_ - rK                 (unblinds, so C = kY)

All the mint ever signed is the blinded point B_. It never saw Y or x. The pair (x, C) the wallet obtains after unblinding is the token, and when the mint later receives this pair it can multiply by k and confirm the signature is its own. It can confirm that much, but it cannot link the token to any particular issuance. Like a bank teller who signed envelopes all day: shown a document at the counter later, they recognize their own signature but cannot recall which envelope it came from.

What Actually Happens at the Mint

From the user's side, ecash consists of three operations.

Minting. Pay the mint's invoice from a Lightning wallet or another mint, and the mint signs tokens for that amount. The mint uses a different key per denomination and, by convention, issues denominations in powers of two: 1, 2, 4, 8 sats and so on.

Sending. A token is just data. It fits in a single string starting with cashu, so it can travel by messenger, QR code, or email. It does not pass through a payment network; it changes hands the way cash does. But a string can be copied, so the recipient must promptly take it to the mint and swap it for fresh tokens. That swap is what invalidates the copy left behind with the sender.

Melting. Return tokens to the mint and have it pay a Lightning invoice. The mint burns the tokens and sends the corresponding amount out over Lightning.

The mint prevents double-spending not with a ledger but with a blacklist. It keeps only the list of secrets x that have already been swapped or melted, and rejects any x it has seen before. No accounts, no balance table, no transaction history.

What matters for the user is that all of Lightning's friction disappears. No channel to open, no inbound liquidity to hunt for, no need to be online to receive. The mint shoulders that friction instead.

What the Mint Sees and What It Cannot See

Put it side by side with a custodial wallet operator and the difference is sharp.

What the mint sees: the amounts and timing of Lightning deposits and withdrawals, the totals it has issued per denomination, and the list of spent secrets. In other words, it knows the total of its own liabilities.

What it cannot see: which deposit became which withdrawal, whose hands a token passed through, who holds how much right now. There is no account database at all, so there is no customer list to leak.

It is worth noticing that this points in a different direction from on-chain techniques like CoinJoin. On-chain privacy techniques blur the trail on a ledger everyone can read; ecash never creates the ledger the trail would be written on. There are limits, of course. The mint does see deposit and withdrawal amounts and timing, so on a mint with very few users, correlation guesses become possible. Your anonymity is only as thick as the crowd using the same mint.

The Trust Model, Stated Honestly

So far this has all been good news, so the other side needs saying plainly. Ecash is custodial. A token is not bitcoin; it is a claim on the mint, and if the mint disappears with the reserves, the token becomes a meaningless string at that instant. Seizure or a hack ends the same way.

There is a subtler problem too. The very cryptography that blinds the mint also blocks outside verification. Since nobody knows whose hands the issued tokens are in, a mint can quietly issue tokens without reserves behind them, running a fractional reserve, and nothing shows until redemptions come due. Schemes for proving reserves and liabilities are being researched, but none is yet a default part of the protocol.

That fixes the proper usage. Money in ecash should be the amount you would carry as cash in a wallet: small sums you can afford to lose, money you are about to spend. Savings belong in self-custody, and the ecash developers themselves are the first to say so.

Splitting the Mint: Fedimint

If trusting a single mint feels like too much, there is a path that splits the mint itself into several parties. That is Fedimint's approach.

In Fedimint, several operators called guardians form a federation. The signing key is created through distributed key generation, so no single guardian ever holds it whole, and tokens are signed with threshold blind signatures: a quorum of guardians must each contribute a signature share before a complete signature exists. State changes go through Byzantine fault tolerant consensus (AlephBFT), so a federation of, say, four guardians keeps running even if one of them goes down or turns malicious. Stealing the reserves requires collusion by a quorum.

The federation itself is not a Lightning node. Payments to the outside world are handled by a separate participant called a gateway. A user locks ecash into a contract with the federation; the gateway pays the invoice from its own Lightning node, then submits the preimage as proof to the federation to collect the ecash. The gateway is not a trusted party but a counterparty that only gets paid by producing evidence.

The two implementations differ in character because they differ in trust structure. Cashu mints are one-person operations, easy to stand up, and numerous enough that switching away from a bad one is easy. Fedimint costs more to establish, but in return it suits community banking, where the guardians are people the community actually knows. Apps like Fedi, aimed at community funds in places where bank access is poor, are the flagship of that direction.

The Return of the Gold-Backed Banknote

Through an economist's eyes, ecash is not a strange object. It has the same structure as a bank that vaulted gold reserves and issued banknotes as claims on them. The mint is the issuing bank, the token is the banknote, and the reserve is bitcoin instead of gold. Even the weakness sits in the same place: the issuer can quietly overissue.

What differs is the speed at which discipline operates. In the banknote era, leaving your issuing bank meant going to the counter, redeeming for gold, and hauling it to another bank. In ecash, redemption is one Lightning payment, a few seconds. Standing up a mint requires no charter, so competition between issuers is open. It is the banknote with the lowest exit cost in history. But market discipline only works when customers actually exercise redemption. The moment you let a balance pile up because it is convenient, the structure regresses to the same weakness as a bank a hundred years ago.

What It Is Actually For

Where ecash is used today lines up exactly with this trust model.

• Small everyday payments and tips: money in the hundreds to tens of thousands of sats, passed around like cash.
• Lightning onboarding: a frictionless entry path for small holders for whom channel-opening costs are not worth it.
• Wallets for machines: you can hand over only a budget you can afford to lose, which made it a natural fit for AI agent payments.
• Community funds: village-scale custody run as a Fedimint federation where banks are absent or untrustworthy.

Closing

Ecash is not a replacement for self-custody. If there are small amounts you were going to hand to someone for convenience anyway, you can now choose between a custodian that keeps a ledger and a custodian that cannot keep one. That is the thing ecash changed.

Chaum's answer waited forty-four years to find its place. Issuance now belongs to Bitcoin, which asks nobody's permission; settlement between custodians belongs to Lightning; privacy belongs to the blind signature. What went bankrupt in 1998 was not the idea, but the structure that kept the idea chained to banks.