Chaumian eCash is a family of digital-cash systems based on David Chaum’s work. A wallet, an application for storing and using digital coins, obtains blindly signed digital coins from an issuer, often called a mint. Mathematical blinding separates the issuance of a particular coin from its later use. The issuer still handles acceptance or redemption and, in common online systems, prevents double spending.
When Anna sees a balance in an ordinary payment app, she is usually looking at an account maintained by its operator. With eCash, she can instead hold digital claims to value directly, called coins or tokens. Each contains data and an endorsement calculated by software using the issuer’s secret data; it is not a metal coin or automatically a new cryptocurrency. The aim is to make payments more like cash, where every small purchase need not leave an easily linked record of the payer. David Chaum developed this idea long before Bitcoin, and his company DigiCash brought it into practice. [1] [3]
The issuer is often called a mint. Here that means a service, not a machine stamping metal. Anna might send it funds and receive digital coins in her wallet in return. In Bitcoin-based systems, amounts may be expressed in sats, or satoshis, Bitcoin’s smallest units. The crucial question is who holds the actual funds for which the coins were issued. If the mint holds them, Anna has a claim on it, rather than bitcoin controlled exclusively by her own keys—the secret data used to sign Bitcoin transfers. The same balance in sats on a screen can conceal very different custody arrangements. [8] [6] [7]
The wallet prepares secret random data for a new coin and mathematically disguises it before signing. The issuer sees the requested value and checks permission to issue it, but cannot see the original hidden data. After receiving the signature, the wallet removes the disguise without destroying the endorsement’s validity. This is a blind signature. Imagine a verifiable stamp on a slip inside an opaque envelope; mathematics does the real work. Crucially, a correctly performed signature does not itself tell the issuer which earlier withdrawal corresponds to the coin later presented. The precise signing and verification methods differ between systems. [1] [3] [8]
Anna sends Peter a token, perhaps in a message. Peter now has the necessary data, but Anna could have copied the same data. In Cashu, the recipient’s wallet therefore asks the mint to swap the received coins for new ones prepared by the recipient. The mint invalidates the old coins and issues the new ones. Only once this succeeds can the sender no longer spend a copy of the original coins. This process also allows the new coins to be unlinked from those surrendered. A QR-code image or a message-delivery tick is therefore not proof that the recipient already controls the value safely. [8] [9]
A double spend is an attempt to spend the same value more than once. An online mint records used coin data and rejects reuse. This prevents a user from simply copying money. The database alone does not prove that the issuer holds enough reserves or is not issuing additional unbacked coins. Protection against a dishonest user must be distinguished from trust in the operator. Even a valid cryptographic endorsement of a coin is not a statement of its reserves. If the issuer stops cooperating, a holder may have a valid token yet be unable to get the underlying funds back. [2] [6] [8]
Passing data between two disconnected phones is one thing; safely establishing that nobody has just spent it elsewhere is another. Some methods allow signature authenticity to be checked offline, but that alone does not reveal the coin’s current status. Historical research by Chaum, Amos Fiat and Moni Naor also described offline cash in which repeated spending could expose the offender afterwards. That does not mean every wallet today uses this mechanism. When a payment is described as offline, distinguish data transfer, authenticity checking and protection against double spending. [2] [10]
A wallet need not hold a separate coin for every imaginable amount. It can combine coins of different values and swap them when needed. Imagine a balance of 500 sats and a payment of 300 sats. Ignoring fees, Anna wants coins totalling 300 sats to send and 200 sats to keep. If she lacks a suitable combination, Cashu allows a swap at the mint that replaces old coins with new ones. This is not a currency conversion or a profit from making change. Actual fees and supported denominations depend on the particular system’s rules. [8] [9]
Blind signatures limit links between a coin’s issuance and its spending. They do not erase a delivery address held by a merchant, an app login, network traces or a distinctive combination of time and amount. An ordinary token without an additional lock can be spent by whoever obtains its secret data. Publishing it is therefore not like publishing a receiving address. Nor should a wallet backup be assumed to solve every problem. Cashu recovery, for example, may require the mint’s cooperation as well as backup words. A backup cannot recover value someone else has already spent or replace the issuer’s missing reserves. [3] [11] [12]
GNU Taler uses blind signatures to protect customers while also making merchants’ income traceable. It is not designed to hide every participant from everyone. Cashu provides a protocol for Bitcoin-based electronic cash using mints. Fedimint distributes administration across a federation—a group of guardians—so no single person controls the funds. A sufficiently large group of guardians can still endanger custody or issue unbacked coins. A federation redistributes trust rather than removing it. These projects should not be treated as interchangeable just because they share a related cryptographic idea. [4] [5] [6] [13]
Bitcoin verifies transfers across a network under shared rules without a central issuer, but has a public transaction history. eCash can move some payments into a more private issuer-run environment and connect to Bitcoin through, for example, Lightning Network, a network of payment channels for fast payments. Channel participants update how previously committed bitcoin is divided between them, without recording every individual payment in Bitcoin’s public history. Depositing or withdrawing via Lightning does not automatically turn a mint’s token into bitcoin in your own custody. Start with three questions: who holds the underlying money, who can refuse redemption, and who sees which payment information? Together, the answers give an honest picture of what a particular eCash system offers. [6] [7] [13] [14]
For the clearest picture, read this entry together with David Chaum, Blind Signature, DigiCash, Cashu, Fedimint, Double-spend. The reverse links also lead from DigiCash, Reusable Proofs of Work, The Crypto Anarchist Manifesto, Blind Signature.