Calle on Ecash, Cashu, and the Fight for Financial Privacy

Cashu creator Calle joins the show on the future of digital cash: why physical cash is disappearing, how Chaumian ecash on Bitcoin answers the surveillance dollar, the honest custodial trade-off, and why financial privacy is the fight that decides the rest.

Marty Bent

January 17, 2025Updated June 7, 20269 min read

↓ Jump to the video and timestamps

Calle is the developer behind Cashu, the protocol that revived a piece of 1980s cryptography most people had given up on and rebuilt it on top of Bitcoin. He came on the show to make an argument that sounds simple and turns out to be the whole game: physical cash is disappearing, everyone is going to use digital money whether they like it or not, and the only real question left is what kind of digital money we get.

There are two answers on the table. One is the surveillance dollar, the programmable, freezable, fully-monitored money that arrives as a central bank digital currency or as the privately-issued stablecoins that do the same job. The other is open, permissionless digital cash that preserves privacy by design. Calle's whole project is to make sure the second option exists and works before the first one becomes mandatory.

This conversation is the defense side of a story I told in detail in a separate piece on how the digital dollar is arriving without a CBDC. If you want the threat, read that. This is the answer to it.

Key takeaways

Cash is being eliminated, and the fight is over what replaces it. Calle's framing: digital money is inevitable, so the only question is whether it's surveilled-by-default or private-by-design. There is no third option where paper cash sticks around forever.
The CBDC is coming, and slowly is our advantage. "The central bankers aren't sleeping," Calle says, but they are slow, which leaves a narrow window for builders to ship a safe alternative before the surveillance version becomes the only choice.
Privacy you don't have at the point of payment is privacy you don't have at all. You can lock down everything else about your life, but the moment a transaction touches a card network, three or four companies can see it and any one of them can decline it. Financial privacy is the load-bearing piece.
Chaumian ecash predates Bitcoin by twenty years and failed for one reason: permission. David Chaum invented the cryptography for private digital cash in the 1980s, but it had to run on top of the permissioned banking system. Satoshi's contribution was the base layer no one has to ask permission to build on.
Cashu is honest about its trade-off. A Cashu mint is custodial: you trade trust in the mint operator for privacy, speed, and a near-frictionless experience. Calle is upfront that this is a different security model from holding your own keys, which is exactly why it's worth taking seriously rather than overselling.
The defense needs builders more than it needs price. Bitcoin's survival depends on developers shipping privacy tools, and Calle's worry is a shortage of them, not a shortage of buyers.

Cash is disappearing. The only question is what replaces it.

Calle opens with the premise that drives everything else:

The central bankers aren't sleeping and the CBDC is going to come. The good thing is that they are very slow, so we need to be able to provide a safe alternative for people who don't want any of that.

His point is not that a government digital currency is imminent next quarter. It's that the direction of travel is fixed. Physical cash, the one instrument in the system that is private and permissionless by default, is being phased out of daily life. Whatever replaces it will be digital, and digital money is built by someone, with rules baked in by someone. The window is the time it takes the slow-moving institutions to finish building the surveilled version, and the job is to ship the private version into that window.

Why financial privacy is the fight that decides the rest

Calle makes the case that financial privacy is not one privacy concern among many but the one that quietly governs all the others. You can use an encrypted messenger, turn off location services, and be careful about what you post, and none of it survives contact with a card terminal. The moment you pay for something, the transaction passes through several intermediaries, each of whom can see it, profile it, and refuse it. The richest, most behavior-revealing data trail you produce is the one you have the least control over.

That's why he frames the loss of cash as urgent rather than abstract. Take away the private default and reconstruct everything on rails that report by design, and surveillance stops being something that requires a warrant and becomes the ambient condition of participating in the economy.

Chaumian ecash: the idea that was twenty years early

The cryptography for private digital cash already exists, and it's older than Bitcoin. Calle walks through the history. David Chaum, the cryptographer, invented blind signatures in the early 1980s, a method that lets a party sign a transaction without seeing its contents, which is the primitive that makes private electronic money possible. Chaum built it into a company, DigiCash, in the 1990s, and the interest was real: banks and technology companies looked hard at putting it into production, and at one point there was a path to bundling a digital-cash wallet into consumer software at scale.

It failed, and Calle's read on why is the important part. The proximate reasons were business missteps. The structural reason was permission. Chaumian ecash, in the 1990s, had to run on top of the existing banking system, which meant the whole stack was permissioned and a single company sat in the middle as a chokepoint that could be pressured or shut down. The only genuinely non-permissioned money in the world was still physical cash.

What Satoshi added, in Calle's telling, was the missing layer: a base money that no one has to ask permission to issue or build on. That's the unlock. The Chaumian-ecash dream that died on the permissioned fiat rails can now be built on top of Bitcoin, without asking JPMorgan or anyone else for the right to exist. Calle quotes Chaum's own statement of the stakes, and it's the line from this conversation worth sitting with:

Without privacy, democracy is not possible. If you cannot have a private life, you are not able to form your own independent ideas.

Cashu and Fedimint: ecash on Bitcoin, and the honest trade-off

Ecash on Bitcoin is real and shipping today, in two main flavors. Fedimint, built by Eric Sirion's team, uses a federation, a group of operators who jointly hold the funds, which spreads trust across multiple parties. Cashu, Calle's protocol, uses a single-operator mint, which makes it extremely lightweight, fast to stand up, and easy to use. He deliberately designed Cashu as a protocol rather than an app, specifying it openly so that many independent developers could build interoperable implementations, and dozens have.

Calle is careful about the part that's easy to gloss over. A Cashu mint is custodial. When you hold ecash from a mint, you are trusting the mint operator with the underlying Bitcoin in exchange for privacy, instant settlement, and a near-frictionless experience. He describes Cashu as one of the best custodial Lightning wallets you can use, and the word custodial is doing real work in that sentence. This is a different security model from self-custody, and the honesty about it is why the argument holds up. The privacy is genuine; the trade-off is genuine; you choose with both in view.

Hash pools: the first time ecash gives back to Bitcoin

The most forward-looking part of the conversation is a project using ecash to pay Bitcoin miners. Today mining pools are custodial by nature: the pool accrues a balance for each miner and the miner withdraws it, which means the pool can link payouts to identities and build a full picture of who mined what. Paying miners in ecash breaks that. The pool can't track an individual miner across time, can't tie a payout to an on-chain identity, and can't see what a miner does with the proceeds. Calle frames mining as one of the more centralization-prone, regulation-exposed parts of Bitcoin, which makes improving miner privacy more than a nice-to-have. It's the first project, in his view, where ecash stops being a thing built on Bitcoin and starts giving something back to it.

Nostr, narrative, and the shortage that actually matters

Two threads close the conversation. The first is Nostr as an on-ramp: an ecash wallet can live inside a Nostr client, so a user earns and spends without leaving the protocol, which may turn out to be an easier path into Bitcoin than Bitcoin itself. The second is the narrative fight. Calle argues, and I agree, that financial privacy has the same image problem encryption had a generation ago, when private messaging was framed as something only criminals needed and is now simply how everyone sends a message. Privacy has to be rehabilitated in the public mind as the default of ordinary, honest people, because, as he puts it, it's overwhelmingly the good guys who need it. His closing worry isn't the price of Bitcoin. It's that the whole defense depends on developers, and there aren't enough of them building.

More on the surveillance dollar

Calle is describing the alternative to a system I documented separately: the way the digital dollar is arriving not as a Fed CBDC but as private, freezable, surveilled stablecoins. The full account, including the GENIUS Act's freeze-and-block requirements and Tether's documented freezes, is here: The Digital Dollar Is Already Here. It Just Isn't a CBDC. Calle's work is the answer to the problem that piece lays out.

Frequently Asked Questions

Why did Chaumian ecash fail in the 1990s if the cryptography already worked?

The cryptography worked fine. David Chaum had blind signatures figured out in the early 1980s, and there was real commercial interest in putting ecash into production. The structural problem was that it had to run on top of the permissioned banking system, which meant a single company sat in the middle as a chokepoint that could be pressured or shut down. Without a permissionless base layer, the whole stack could be killed by leaning on one entity.

What did Bitcoin actually add to the ecash picture that didn't exist before?

Satoshi provided the missing layer: a base money that no one has to ask permission to issue or build on. Chaumian ecash in the 1990s needed JPMorgan or someone like them to cooperate. Cashu doesn't. That's the difference between a privacy tool that survives and one that gets strangled at the chokepoint.

Is Cashu self-custodial like a hardware wallet, or is there trust involved?

There's trust involved, and Calle is upfront about it. A Cashu mint is custodial. You hand over the underlying Bitcoin to the mint operator and receive ecash tokens in return. What you get for that trade is genuine privacy, instant settlement, and a near-frictionless experience. It's a different security model from holding your own keys, and you should go in with both facts in view.

How is Fedimint different from Cashu if they're both ecash on Bitcoin?

Fedimint uses a federation, meaning a group of operators who jointly hold the funds, which spreads trust across multiple parties rather than concentrating it in one. Cashu uses a single-operator mint, which makes it extremely lightweight and fast to stand up. Both are real and shipping today. The choice between them is a choice about which trust model fits the situation.

Why does Calle think financial privacy is more important than other kinds of privacy?

Because it's the one that undermines everything else. You can run an encrypted messenger, kill location services, and watch what you post online, and none of it survives contact with a card terminal. The moment you pay for something, the transaction passes through several intermediaries who can see it, profile it, and refuse it. The data trail you have the least control over is also the richest, most behavior-revealing one you produce.

What does ecash have to do with Bitcoin mining, and why does it matter for decentralization?

Today mining pools are custodial by nature. The pool accrues a balance for each miner, links payouts to identities, and builds a picture of who mined what. Paying miners in ecash breaks that link. The pool can't track an individual miner across time or tie a payout to an on-chain identity. Calle sees mining as one of the more centralization-prone and regulation-exposed parts of Bitcoin, which makes this the first project where ecash stops being a thing built on Bitcoin and starts giving something back to it.

What's the comparison Calle makes between financial privacy today and encryption a generation ago?

He argues financial privacy has the same image problem that private messaging had before encryption became the default for ordinary communication. Private messaging used to be framed as something only criminals needed. Now everyone uses it and no one thinks twice. The same reframe has to happen for financial privacy, because, as he puts it, it's overwhelmingly the good guys who need it.

About Calle

Calle is the creator of Cashu, a free and open-source Chaumian ecash protocol built on Bitcoin and Lightning. He works on financial-privacy technology and is pseudonymous.

Sources mentioned

Cashu: Calle's Chaumian ecash protocol
Fedimint: federated ecash on Bitcoin
Nostr and NIP-60: ecash wallets inside Nostr clients
David Chaum, blind signatures, and DigiCash: the 1980s and 90s origins of digital cash
The digital dollar, explained: the CBDC/stablecoin threat this episode answers

Watch the conversation

Timestamps

0:00 - Intro
0:40 - Programming is art
5:40 - Zooming out on the struggle for freedom
10:27 - Dealing with the pace of change
14:24 - Unchained & Fold
16:17 - Financial privacy
20:47 - Chaumian ecash history
33:38 - Zaprite & SOTE
35:10 - Ecash on Bitcoin
42:59 - Hash pools
48:49 - Interoperable systems
52:15 - We need more privacy and more devs
55:28 - Narrative and communication
1:00:49 - Magic stuff that just works
1:10:23 - Nostr as a gateway to Bitcoin
1:17:25 - Wrap up