What Is Cashu Ecash on Bitcoin?

Cashu is an open protocol for Chaumian ecash on Bitcoin using Lightning. Learn how mints, blind signatures, bearer tokens, and custodial trade-offs work.

By Jonathan West · Updated October 2026

Cashu is an open protocol for Chaumian ecash on Bitcoin where mints issue bearer tokens against Lightning payments, using blind signatures to prevent the mint from linking withdrawals to later spending.

Cashu tokens provide private, instant bearer transactions for Bitcoin, but users must trust the mint operator holding the underlying funds.

About cashu ecash

Cashu is an open protocol for Chaumian ecash on bitcoin: a mint issues bearer tokens in exchange for Lightning payments, and blind signatures stop the mint from linking the withdrawal to later spending. On its official site, Cashu describes itself as an open protocol for Chaumian ecash on bitcoin where mints issue bearer tokens against Lightning, wallets hold them, and blind signatures keep a mint from tying the withdrawal to the spend that follows it. Wallets run on iOS, Android, or directly inside a web browser, and the site notes they are independent, open source, and free. Cashu issues cryptographic bearer strings that represent balances backed by bitcoin deposited with an ecash mint. Ecash on Cashu is a claim on its mint, not a bank deposit. On the project website, Cashu states: "Bitcoin in, bitcoin out. Mints bridge Lightning and ecash." The mint operator holds the actual bitcoin on the Lightning Network, while users hold local digital tokens. This arrangement means Cashu is custodial by design. If a mint operator disappears, suffers a technical compromise, or refuses to redeem tokens, the tokens issued by that specific mint can become worthless. Understanding this custodial relationship is necessary before using any ecash wallet, because users take on counterparty risk with whichever mint they choose to interact with. Tokens issued under the protocol function as bearer strings of bitcoin. Cashu describes these tokens as instant, final, and small enough to fit anywhere text goes, including a chat message, a QR code, an email, or an HTTP header. Wallets let users hold bearer tokens the way they hold physical cash. Because these strings are bearer assets, whoever holds the string possesses the ability to spend it. If a user loses a token string or leaks it to an attacker, the funds cannot be recovered. Cashu is not designed for storing long-term savings, because ecash requires trusting an outside mint operator with custody of the underlying bitcoin. Anyone looking for sovereign control over large balances should keep their funds in a dedicated self-custody wallet rather than an ecash mint. Our verdict is that Cashu provides genuine transactional privacy through blind signatures, but users must treat ecash tokens like physical pocket change and test only trivial amounts.

How it actually works

The Cashu protocol operates through specific technical interactions among wallets, mints, and cryptographic tokens. The underlying rules are documented in version-controlled Notation, Usage, and Terminology (NUT) specifications in the cashubtc/nuts repository. The mandatory specifications define the baseline rules of the protocol: NUT-00 covers Cryptography and Models, NUT-01 covers Mint public keys, NUT-02 covers Keysets and fees, NUT-03 covers Swapping tokens, NUT-04 covers Minting tokens, NUT-05 covers Melting tokens, and NUT-06 covers Mint info. The protocol also contains optional specifications, including token state check (NUT-07), spending conditions (NUT-10), pay-to-pubkey (NUT-11), discrete logarithm equality (DLEQ) proofs (NUT-12), deterministic secrets (NUT-13), hashed timelock contracts (HTLCs, NUT-14), animated QR codes (NUT-16), and payment requests (NUT-18).

In the vocabulary of the Cashu specification, three operations manage token lifecycles: minting, melting, and swapping. Minting turns a Lightning payment into tokens at a mint per NUT-04. When a user deposits funds via a Lightning invoice, the mint signs newly generated cryptographic tokens. Melting turns tokens back into a Lightning payment per NUT-05, allowing a user to redeem their bearer tokens to pay an outside Lightning invoice or withdraw bitcoin to an external wallet. Swapping exchanges existing tokens for new tokens at the same mint per NUT-03.

Privacy in Cashu relies on Chaumian blind signatures. As Cashu states, a blind signature lets a mint issue a token without learning who ends up holding it. The mint can verify its own signature upon redemption, but it cannot link the specific token presented during spending to the original withdrawal transaction. While the mint operator can in principle see amounts it signs, it cannot learn who ends up holding the token.

Cashu tokens are bearer strings of bitcoin. Whoever holds the string can spend it at the mint. A token leaked in a chat or stored insecurely on an internet-connected device can be redeemed by anyone who copies the text. Because tokens are bearer strings, a lost or leaked string cannot be recovered. To support development across diverse platforms, Cashu includes eight implementations across Python, Rust, TypeScript, and Kotlin hosted under the cashubtc organization. Named projects include nutshell for a wallet and mint, cdk as a development kit, and coco as a wallet toolkit, with the project site distributed under the MIT license.

Using Cashu requires understanding the difference between self-custody and holding a claim against a mint. The mint operator retains custody of the bitcoin on the Lightning Network. Choosing a mint is an explicit trust decision. To evaluate trade-offs between holding claims on an intermediary and maintaining direct control of private keys, review self-custody vs a custodian and the guide on what is a non-custodial wallet. If a mint operator disappears, is hacked, or refuses redemption, the tokens can become worthless. For this reason, users should treat ecash balances strictly as short-term pocket money.

Start here

1Decide why you want to use Cashu before transferring any funds. Evaluate whether your priority is transactional privacy and fast transfers for small amounts, or whether you require self-custodial storage.
2Read the mint info documentation via NUT-06 for your chosen mint. Review the mint info and keysets published by the mint operator before connecting your wallet.
3Start by testing a trivial amount of bitcoin. Because ecash is a claim on an external mint rather than an on-chain deposit, never deposit significant funds into an experimental mint.
4Back up your wallet seed or individual token strings according to your specific wallet software documentation. Because tokens are bearer strings, a lost or corrupted wallet file without a backup results in the total loss of those tokens.
5Perform a test swap and redemption to confirm operational functionality. Send a small token string to another wallet or melt the tokens back into an external payment to verify that the mint executes Lightning withdrawals reliably.
6Never store more value in a Cashu mint than you would carry as physical paper cash in your pocket. Treat every ecash balance as money that could be lost if the mint operator goes offline.
7Keep your long-term bitcoin savings in dedicated self-custody.

Strengths

Cashu provides strong transactional privacy through Chaumian blind signatures. As Cashu states, a blind signature lets a mint issue a token without learning who ends up holding it, preventing the mint from connecting withdrawals to later spending.
Tokens operate as instant and final bearer strings of bitcoin. Cashu tokens are compact enough to fit anywhere text goes, including a chat message, a QR code, an email, or an HTTP header.
The protocol is fully open source and documented through modular specifications known as NUTs. Developers can inspect, build, and extend features using public standards in the cashubtc/nuts repository.
Cashu features multiple independent implementations across Python, Rust, TypeScript, and Kotlin. Tools like nutshell, cdk, and coco allow developers to run standalone mints or integrate ecash wallets on iOS, Android, and web browsers.

Common misunderstandings

Cashu is custodial by design because the mint holds the underlying bitcoin. If a mint operator disappears, suffers a server breach, or refuses redemptions, users can be left holding worthless tokens.
Tokens are digital bearer strings, meaning whoever holds the string can spend it. If a token string is leaked, copied, or lost without a backup, the funds cannot be recovered or refunded.
Running or choosing an ecash mint is a strict trust decision. Users must rely entirely on the operational competence, financial solvency, and honesty of the individual or group managing the mint infrastructure.
Cashu is documented as eight implementations across four programming languages, and each wallet and mint differs, so read the project's own documentation before relying on any of them.

Common questions

What is Cashu?

Cashu is an open protocol for Chaumian ecash on bitcoin. On its official website, Cashu explains that mints issue bearer tokens against Lightning, wallets hold them, and blind signatures keep a mint from tying the withdrawal to the spend that follows it. Wallets run on mobile devices or in web browsers, and the protocol is specified across modular documents called NUTs.

Is ecash the same as Lightning?

Ecash is not the same as Lightning, though Cashu uses the Lightning Network to move bitcoin into and out of mints. In Cashu terminology, mints bridge Lightning and ecash by accepting Lightning payments to mint tokens and melting tokens to pay external Lightning invoices. Cashu transfers happen as direct exchanges of cryptographic bearer strings. For more on routing and channels, see the guide to lightning network wallets and lightning network fees.

Is Cashu custodial?

Cashu is custodial by design because the mint holds the actual bitcoin on the Lightning Network. As Cashu documents, ecash is a claim on its mint, not a bank deposit. If the mint operator shuts down, loses the backing bitcoin, or refuses to honor redemptions, users can lose their funds. To understand how this compares to sovereign wallet setups, read about self-custody vs a custodian.

What is a Cashu mint?

A Cashu mint is the server that bridges the Lightning Network and ecash bearer tokens. The mint issues tokens when it receives a Lightning deposit (minting), redeems tokens to pay external Lightning invoices (melting), and swaps old tokens for new tokens (swapping). The mint signs tokens using blind signatures, so while it manages the underlying bitcoin reserves, it cannot determine which user spends a token or track recipient transaction histories.

What happens if a mint shuts down?

If a Cashu mint shuts down or disappears, any tokens issued by that mint become unredeemable. Because ecash tokens represent a claim on that specific mint's bitcoin reserves, no outside party or blockchain protocol can enforce repayment. This makes choosing a mint an important trust decision, and users should never leave large balances stored inside an ecash mint.

What does Chaumian mean?

Chaumian refers to a blind-signature ecash scheme. Cashu implements this model using blind signatures to ensure that the mint cannot link the cryptographic token it signs during a withdrawal to the token presented for spending later. On its official site, Cashu describes itself as an open protocol for Chaumian ecash on bitcoin.

Sources

Ready to put this into practice?

Exchange sign-up bonuses pay both you and a referrer after a qualifying trade.

See bonuses →