Magazine · Mining & technology
Fedimint: Shared Custody Explained
Fedimint explained: how a federation of guardians holds bitcoin together, why Chaumian e-cash is private, whom you trust and how Cashu differs.
Fedimint is open-source software that lets a group of custodians, the guardians, hold bitcoin together for a community. In return, members receive digital tokens, so-called Chaumian e-cash, which they use to pay each other and over Lightning. Because the tokens are signed blindly, the guardians don't know who owns which token. Fedimint is thus custody by third parties, but spread across several people and with far more privacy than an account at an exchange.
The problem Fedimint tries to solve
Self-custody is the ideal for bitcoin: your keys, your coins. How to set it up properly is described in the custody guide. In practice, though, many people fail at exactly this step: securing a seed phrase, managing Lightning channels, understanding fees. They end up at exchanges or custodial wallets, where one company knows everything and can do anything.
Fedimint sits in between. The idea comes from the developer Eric Sirion, who started the software in early 2021. Instead of a company, a small group of people the community knows holds the funds: in a village, say, the teacher, the shopkeeper, someone good with IT and the mayor. None of them alone can reach the bitcoin. And none of them sees who owns how much or who pays whom.
The model is older than Bitcoin. In 1982 the cryptographer David Chaum described blind signatures for anonymous digital money and later founded the company DigiCash. It failed in 1998, because it needed a central company with banking partners. Fedimint takes Chaum's method and replaces the single company with a federation that holds bitcoin instead of bank deposits.
How a federation works
A Fedimint federation consists of several guardians, each running a server. Together these servers form three building blocks:
- Wallet: deposited bitcoin sit in a multisig address on the blockchain. With four guardians, a withdrawal might need three signatures. What multisig means in general is explained in the article on multisig wallets.
- Mint: the guardians jointly issue and redeem e-cash tokens. A token is a bearer instrument: whoever holds the token's data owns the amount.
- Lightning connection: so-called gateways, independent Lightning nodes, swap e-cash for Lightning payments and back. That lets members pay invoices outside and receive money.
The guardians agree through a consensus protocol that keeps working correctly even if individual servers fail or even lie. This is called Byzantine fault tolerant.
Depositing and withdrawing
- Deposit: you send bitcoin to the federation's address or pay a Lightning invoice through a gateway.
- Receive tokens: your app creates secret tokens, disguises ("blinds") them and has the mint sign them. The app then removes the blinding. What remains is a validly signed token the mint has never seen.
- Pay: you hand tokens to someone else in the same federation, or a gateway turns them into a Lightning payment for you.
- Redeem: whoever receives tokens submits them to the mint and gets new ones. The mint checks that each token is valid and has not been spent before.
How a blind signature works
Chaum's original scheme can be shown with RSA. The mint has a public key (n, e) and a secret key d.
- You choose a token m and a random number r. You send the mint only the blinded number m′ = m · rᵉ mod n.
- The mint signs blindly: s′ = (m′)ᵈ = mᵈ · r mod n.
- You divide by r and get s = mᵈ mod n, the mint's valid signature on m.
The mint never saw m. When someone later submits m with signature s, it can check that the signature is genuine, but not at which signing it was created.
Instead of RSA, Fedimint uses a threshold scheme (threshold blind signatures): each guardian signs a share, and from a minimum number on the shares combine into the full signature. Cashu uses a variant on elliptic curves (Blind Diffie-Hellman Key Exchange).
Denominations: tokens come in powers of two. 13 satoshis are 8 + 4 + 1, i.e. three tokens.
Fault tolerance: with n guardians, consensus tolerates f faulty or malicious servers as long as n ≥ 3f + 1. Four guardians tolerate one, seven tolerate two.
Privacy: what the guardians see and what they don't
At an exchange, the operator sees every account, every amount and every transfer. Fedimint is different:
- Not visible: who holds which tokens, how much an individual member has, and who pays whom inside the federation.
- Visible: that bitcoin are deposited into or withdrawn from the federation, with amounts on the blockchain. And how many tokens are in circulation in total.
- Visible to the gateway: whoever pays out over Lightning gives the gateway the invoice. The gateway thus sees recipient and amount, but not which member is paying.
It is not watertight. If you deposit 0.013 BTC and exactly that amount is withdrawn shortly afterwards, a link can be guessed. Small, round and time-shifted amounts protect better. How Bitcoin privacy works in general, and why Bitcoin is pseudonymous rather than anonymous, is explained in Bitcoin privacy.
The trust model: whom you trust with Fedimint
Fedimint is custody by others. That has to be said clearly. Your tokens are only worth what the federation redeems them for.
What happens if individual guardians fail? With four guardians and a threshold of three, everything keeps running if one fails. If two fail, the federation stands still until one is back. Money is not lost then, but not reachable.
What happens if guardians cheat? If as many collude as the threshold requires, they can drain the bitcoin from the multisig address. They could also issue more tokens than there are bitcoin deposited. As a member you can hardly verify that from outside.
What happens under outside pressure? If all guardians live in the same country, an authority can compel them together. Federations whose guardians live in different countries are harder to coerce.
The advantage over an exchange: instead of a single company, several people you know, who have a reputation to lose in the community, would have to band together. How it ends when a single custodian fails is shown in Crypto exchange bankrupt.
Fedimint and Cashu compared
Cashu pursues the same idea with less effort. The developer Calle presented it in 2022. A Cashu mint is run by one operator, often a single person, and speaks Lightning. Wallets such as Minibits or cashu.me connect to one or more mints. Tokens can even be sent as a line of text in a chat.
| Fedimint | Cashu | Exchange / custodial wallet | Self-custody | |
|---|---|---|---|---|
| Who holds the bitcoin? | several guardians (multisig) | one mint operator | a company | you |
| Operator sees balances? | no | no | yes | nobody |
| One operator fails | tolerable up to the threshold | mint stands still | service stands still | affects no one but you |
| Who can steal? | a majority of guardians | the operator | the company | whoever finds your keys |
| Effort to operate | several servers, coordination | one server | a company | wallet, backup |
| Suited for | communities, families | small amounts, experiments | buying and selling | savings |
Cashu is easier to start, but the single operator is a single point of failure. Fedimint spreads the risk and in return needs several reliable guardians.
Legal situation in Germany, Austria and Switzerland
Holding bitcoin for others is, in the EU, generally a licensed activity: custody and administration of crypto-assets on behalf of clients falls under MiCA and requires authorisation. What MiCA regulates for holders is in MiCA and Bitcoin. In Switzerland, FINMA decides under its own rules.
For a federation among relatives or close friends without profit motive, the situation is less clear. As soon as a federation takes in members publicly or charges fees, the guardians should get legal advice. For you as a member this means: your balance is not protected by deposit insurance or supervision.
Who Fedimint suits
Fedimint fits everyday money in a community that knows each other: pocket money for children, a club's cash box, a place where many people have no bank account of their own. The company Fedi builds an app on top of it aimed especially at communities in countries with weak currencies.
Fedimint fits less for your savings. If you hold bitcoin for years, you don't need fast, private payments but keys that nobody else knows. A federation complements self-custody for small amounts; it does not replace it.
Fedimint is not the only way to make Lightning simpler. The Ark protocol tries to enable payments without channels while giving every user their own exit to the blockchain.
Frequently asked questions
What is Fedimint?
Open-source software that lets several guardians jointly hold bitcoin for a community. Members receive e-cash tokens in return, which they can spend privately among themselves and over Lightning.
Is Fedimint self-custody?
No. The bitcoin sit in the guardians' multisig wallet. You trust that not enough of them collude to take them.
What is Chaumian e-cash?
Digital money based on a 1982 scheme by the cryptographer David Chaum. The mint signs tokens blindly and, on redemption, cannot tell whom it issued them to.
What is the difference between Fedimint and Cashu?
Both use e-cash. With Fedimint several guardians run the mint together; with Cashu a single operator does. Cashu is simpler, Fedimint spreads the risk.
What happens if I lose my phone?
If you have your app's recovery words, you can get your tokens back with the federation's help. Without them the tokens are lost like cash.
How much money should I keep in a federation?
As much as you would otherwise carry in your wallet or keep in a payment app. For long-term savings, self-custody is the better place.
Sources
Not financial, legal or tax advice. Models are no guarantee.
The Bitcoin Power Law newsletter
An email when we publish a new article or calculator. Every issue has a one-click unsubscribe link.