+21 sat

CASHU

Open ecash for bitcoin · instant, bearer, peer-to-peer

→ skip

01 · what is ecash

The most flexible banknote ever.

Digital cash you hold yourself. The value lives in the note, not in an account with your name on it.

the mint & its customers

The mint issues notes and holds the money that backs them. That makes it a custodian: you're trusting it to redeem every note it issued. We'll come back to that.

a note is just bytes. send it however bytes travel

bluetoothphone to phone

loralong-range radio

offlineno signal needed

nfctap to hand over

qr codescan a screen

chatsms · nostr · dm

paperprint & hand over

emailattach it

older than bitcoin

1982David Chaum describes blind signatures for untraceable payments

1989Chaum founds DigiCash in Amsterdam

1995Mark Twain Bank in the US issues real eCash

1998DigiCash goes bankrupt. The math survives

what it is not

A blockchainno chain, no miners, no global ledger

A new coinnotes stand for money you already know

An accountno username, nothing tied to you

02 · blind signatures · chaum, 1982 · BDHKE

The mint signs what it cannot see.

— like a notary stamping through a sealed envelope.

The wallet picks a random secret — the serial number of its future coin.

03 · how bitcoin learned to pay

Layered BTC Payments

L3 · CASHUPrivate, instant, sent like a messageecash · no node · no trail

L2 · LIGHTNINGInstant, routed paymentschannels · liquidity · nodes

L1 · ONCHAINThe settlement layerslow · public · final

04 · what is cashu

Hold ecash. Pay bitcoin.

Cashu is an open ecash protocol built on bitcoin. The mint runs the nodes; your wallet holds the notes.

the cashu team

We write the open spec and maintain a few core implementations, so mints, wallets and every other project in the ecosystem can use ecash.

open specopen sourceanyone can run a mint

NUTs · Notation, Usage & Terminology

NUT-00the cryptography

NUT-03swap notes for notes

NUT-04mint: bitcoin in

NUT-05melt: bitcoin out

NUT-11lock notes to a pubkey

NUT-12prove the mint signed it

NUT-23Lightning (BOLT11)

NUT-30onchain payments

05 · the stack

One Spec, Three Core Implementations

06 · the token

{
  "t": [{
    "i": h'00ad268c4d1f5826',  // keyset id
    "p": [{
      "a": 64,              // sats
      "s": h'02ab34c1…9c7cf1',  // blind signature
      "d": h'0248e1b9…5b73e4'   // DLEQ proof
    }]
  }],
  "m": "https://mint.example.com",
  "u": "sat",  "v": 4
}

ikeyset id — which mint keys signed it

a·s·damount · blind signature · DLEQ proof

m·u·vmint url · unit · format

encoded as one string starting with cashuB…

07 · how it moves

Life & Death of a Token

MINTSWAPMELT

MINT · bitcoin in

Pay Lightning, get ecash

Deposit sats → the mint returns blind signatures → your wallet unblinds them into tokens.

Ask the mint for a quote
Get back a Lightning invoice
Pay it over Lightning
Send blinded secrets
Mint signs them, blind
Unblind → spendable tokens

SWAP · token for token

Split, merge, send

Trade old proofs for new ones. No bitcoin moves — this is how a token changes hands.

Alice sends a token — as text
Carol hands the proofs to the mint
The mint (Bob) checks they're unspent, burns them
Fresh proofs come back to Carol
Carol owns it; Alice's copy is dead

MELT · bitcoin out

Burn ecash, pay anyone

Hand proofs back; the mint pays any Lightning invoice you name. The exit.

Bring a Lightning invoice to pay
Hand it to the mint with your proofs
Mint burns the proofs
Mint pays the invoice over Lightning
Unused fee reserve returns as change

The mint sees deposits and withdrawals — but cannot link them.

08 · built with cashu

routstr

LLinky

Build your bitcoin network

Send bitcoin as easily as a message — the ecash token rides inside the chat.

contacts, not addresses
tap a bubble to receive
nostr messaging + Cashu ecash

9:415G ▮

‹MNMia Novak

Today

Message

RequestPay

THIS BUBBLE IS MONEY

M21,000 satDinner

A Cashu token, carried in the message itself. Tap once and it's yours — no invoice, no copy-paste.

github.com/routstr

09 · the tradeoff

10 · when the mint fails

Custody means risk you can name.

A note is only worth the mint's willingness and ability to redeem it. This is how that breaks.

Goes offline

The server dies or the operator walks away. Notes can't be swapped or redeemed until it's back, if it ever is.

Rugs

The operator takes the reserve and runs. Nothing on-chain stops them.

Freezes

It refuses to redeem: one user, everyone, by choice or by court order.

Goes insolvent

More notes out than bitcoin in: hidden losses, a hack, or quiet over-issuance.

Leaks its keys

Whoever steals the signing keys can mint notes from nothing and drain honest holders.

Retires a keyset

Mints rotate keys. Notes left on an old keyset depend on the mint still honouring it.

Gets shut down

A host, a bank or a regulator can pull the plug on the operator, and your notes with it.

So, shrink the trust.

You can't delete these risks, but you can make each one smaller. Here's how. →

11 · trust minimize

Improving Cashu mint trust assumptions.

TEEs

Run the mint inside a trusted enclave — even the operator can't see the keys.

Proof of reserves & liabilities

Publish the books so anyone can check the mint is solvent — no trust-me accounting.

Federated mints

Split signing across operators — no single party can move funds alone.

Multi-mint

Spread balances across mints and auto-rebalance — one failure can't take everything.

Auto-withdraw

Sweep funds back to Lightning automatically — don't idle on a mint.

Let a thousand mints bloom

Many small, competing mints beat one giant one — choice itself is the trust model.

TEEs

PoR/PoL

FEDERATED

MULTI-MINT

AUTO-WD

1000 MINTS

12 · try it today

Try it today.

A full Cashu wallet runs in a browser tab. No install, no account.

open a wallet

cashu.me

A Cashu wallet that lives in your browser. Works on your phone or your laptop.

Open cashu.meadd it to your home screen if you like
Add the test mintit issues fake sats: free to mint, worthless to lose
Break thingsmint, send to a friend, receive, melt. Nothing is at stake

scan · cashu.me

13 · proof

Let's actually spend some.

cashu-xx

pick a mint → pay 100 sats over Lightning →
play → claim real ecash → scan it with a wallet

Thank You!

01 / 15

Cold open (2.0m)
· Two strangers, one token hopping between phones. Hit play, let the clip land.
· After it ends: "That's the energy. First question: what is ecash?"

01 · What is ecash (2.5m)
· On entry: walk the loop. The mint issues a note to Alice, it goes hand to hand to Carol and Bob, and Bob redeems it. The mint never sees the hand-offs.
· Say the custody point plainly: the mint holds the money behind every note, so it's a custodian. Promise to come back to it. Don't mention bitcoin yet.
· Click: a note is bytes, so it moves over anything (Bluetooth, LoRa, offline, NFC, QR, chat, paper, email).
· Click: the history, 1982 to 1998. Click: what it is not.

02 · Blind signatures (2.5m)
· How does a mint sign notes it can never recognise again? Secret goes in, envelope seals, mint signs through it, envelope comes back, opened.
· The mint never saw inside. 1982 math (Chaum, BDHKE).

03 · Layered BTC payments (3.0m)
· Gear shift: how bitcoin itself learned to pay. Bottom up. L1: blocks every ~10 min, fees, every payment public, forever.
· Click: L2 Lightning: instant and cheap, but channels, liquidity, node ops.
· Click: L3: put ecash on top of this and you get Cashu. Next slide.

04 · What is Cashu (2.5m)
· The merge: ecash, backed by bitcoin. The mint runs a Lightning node and a bitcoin node; the wallet only holds notes.
· Point at the loop: pay any invoice or address from your ecash balance, receive the same way. The outside world sees a normal bitcoin payment.
· Click: who we are. We write the spec and maintain core implementations.
· Click: NUTs = Notation, Usage, and Terminology. Explain each one shown in a line.

05 · The stack (1.5m)
· One spec, three core implementations: cdk (Rust), nutshell (Python), cashu-ts + coco (TypeScript).
· If asked "which is canonical?": none; the spec is.

06 · The token (2.0m)
· Click: the cashuB string types out. Click: break it down: keyset, amount/sig/DLEQ, mint/unit/format.
· A token fits anywhere text goes; that's the UX unlock.

07 · Life & Death of a Token (3.0m)
· Each panel loops its flow; narrate the highlighted step.
· Mint = in, swap = hand-off with no bitcoin moving, melt = out. Last click: mint can't link the two ends.

08 · Built with Cashu (3.5m)
· One project per click: routstr, Araphel, TollGate, Real Open Bidding, Linky.
· The token-is-text property is why they all compose.

09 · The tradeoff (1.5m)
· Be honest: a claim on a mint, not a deposit. Point at the last row: one custodian you choose.

10 · When the mint fails (2.0m)
· Click: offline / rug / freeze / insolvent · then leaked keys · then keyset retirement / shutdown.
· Name each one plainly, no hedging. Hand off: you can't delete these, you can shrink them.

11 · Trust minimize (2.5m)
· One idea per click; honest about maturity: some ship, some are research.
· Close on a thousand mints: choice itself is the trust model.

12 · Try it today (1.0m)
· One link: cashu.me. Let people scan the QR.
· The test mint issues fake sats, so they can mint, send and melt with nothing at stake. (Have the test mint URL ready to read out: testnut.cashu.space, confirm before the talk.)

13 · Demo (4.0m)
· Game open before you start. Mint → pay → play → claim → scan on camera.

Thank you (0.5m)
· Say thanks and stop. Q&A.

→ / Space / click-right	next slide / step
← / click-left	previous slide / step
Esc · O	overview grid
N	presenter notes
F	fullscreen
B	blackout
Home / End	first / last slide