Overview
Ecash is a digital cash system originally conceived by cryptographer David Chaum in the 1980s. It uses blind signatures to create tokens that are unlinkable to their issuance, providing strong transactional privacy. In the Bitcoin ecosystem, ecash has been revived through projects like Cashu and Fedimint, which issue bitcoin-denominated tokens that can be transferred instantly and privately within a mint or federation.
How Blind Signatures Work
The key innovation of ecash is the blind signature, which allows a mint to sign a token without knowing its content:
┌──────────┐ ┌──────────┐
│ User │ │ Mint │
└────┬─────┘ └────┬─────┘
│ │
│ 1. Create token T │
│ 2. Blind it: T' = blind(T) │
│ │
│ ──── Send T' + payment ────► │
│ │
│ 3. Sign: S' = sign(T')
│ │
│ ◄──── Return S' ──────────── │
│ │
│ 4. Unblind: S = unblind(S') │
│ │
│ Now (T, S) is a valid token │
│ The mint cannot link T to │
│ the issuance event │
└───────────────────────────────┘
Bitcoin Ecash Implementations
Cashu: A simple, single-mint ecash protocol that integrates with the Lightning Network. Users deposit bitcoin via Lightning and receive ecash tokens that can be transferred to other users of the same mint. Tokens can be redeemed back to Lightning at any time.
Fedimint: A federated ecash system where multiple guardians jointly operate the mint using threshold signatures. This distributes trust across multiple parties, reducing the single-point-of-failure risk of a centralized mint. Fedimints can serve as community banks for local Bitcoin communities.
Privacy Properties
- Sender privacy: The mint cannot determine who originally received a token
- Transaction privacy: Transfers between users within the mint are invisible to the mint operator
- Amount privacy: Tokens of the same denomination are indistinguishable from each other
Trade-offs
Ecash offers excellent privacy and instant settlement but comes with important trade-offs:
- Custodial risk: Users must trust the mint (or federation) to honor redemptions. The mint holds the underlying bitcoin.
- Mint scope: Tokens are only valid within the issuing mint; cross-mint transfers require Lightning as a bridge
- Rug-pull risk: A single-operator mint could theoretically abscond with all deposited funds (federated mints mitigate this)
Common Misconceptions
- Ecash tokens are not on-chain Bitcoin transactions. They exist entirely within the mint's domain.
- Ecash does not provide privacy against the mint itself for deposit and withdrawal operations -- only for token transfers between users.
- Despite being custodial, ecash provides stronger privacy guarantees than most non-custodial Bitcoin usage patterns.