Author: Juan Galt
Source: https://bitcoinmagazine.com/business/the-history-and-future-of-physical-bitcoin
Bitcoin's electronic nature brings most of its advantages. Because it is programmable, it's possible to create self-storing mechanisms that make theft and forfeiture difficult. Because it's electronic, it can travel at the speed of light, so value can cross the globe and be settled in minutes.
However, Bitcoin is sometimes criticized for being difficult to grasp (literally). This is because, in its natural state, it cannot be touched or held in the hand; it can only be imagined and understood. For many, this is a significant obstacle; and it has inspired numerous attempts to make this currency tangible—though this is no easy task.
For over a decade, entrepreneurs and artists have been trying to make Bitcoin a physical commodity while retaining its most valuable, cash-like properties. While no one has completely solved the problem, significant progress has been made, leaving behind many exquisite works of art.
Casascius Coin
-Image courtesy of Stacks Bowers Galleries-
Launched as early as September 6, 2011, when Bitcoin was priced at only $8, the Casascius coin is undoubtedly the most representative physical Bitcoin artifact in history, with numerous imitators. Its name comes from Mike Caldwell's nickname on the Bitcointalk forum, seemingly meaning "outspoken." The Casascius coin has evolved into many uses, which have been followed and innovated upon by later physical Bitcoins.
One challenge in turning Bitcoin into physical coins is the handling of private keys. Because Bitcoin is electronic, it can only exist within a single cryptographic pair—a secret value used to generate a public key, which is then used with Bitcoin-compatible cryptography. With the Casascius coins, Caldwell generated the private keys on an airgapped device, printed them out, and glued them onto the marked precious metal coins; then, reportedly, he destroyed any backups left on his computer. He even explained the security measures he took to potential buyers on his website.
These extracted private keys are covered with a special tamper-evident sticker; once the sticker is peeled off, a distinct "honeycomb" pattern is left. Therefore, the coin buyer can determine whether the private key on a Casascius coin has been exposed before they receive it.
Key management is the biggest risk in the creation of physical Bitcoins—and in the case of the Casascius coin, the solution was to trust that he wouldn't lie to us. By the standards of the time, he was always very honest and discreet. To this day, his reputation remains excellent (though not legendary), so these buyers made the right choice, profiting handsomely from these collectibles—they are worth far more today than the Bitcoin they represent plus the precious metals that made them.
Casascius coins ceased issuance in November 2013 after the U.S. Financial Crimes Enforcement Network (FinCEN), a part of the Treasury Department, notified developer Mike Caldwell that minting physical Bitcoins would classify him as a money services business, subject to stringent regulations. The trust element involved in generating private keys—arguably a centralized factor—had consistently drawn criticism.
RavenBit Coins
A year after the Casascius coin ceased issuance, RavenBit emerged , attempting to decentralize the trust factor in the physical Bitcoin minting process. RavenBit coins closely resemble Casascius coins in appearance, except they lack pre-generated private keys; instead, these coins come with unopened tamper-evident stickers, allowing users to generate their own key pairs, attach them to blank coins, and then affix the tamper-evident sticker.
To some extent, this decentralizes the mint, which is a breakthrough in theory. However, in practice, it simply results in countless trusted mints with no brand or reputation, perhaps even using an office printer infected with malware. If you receive a RavenBit coin from someone, how do you know that person hasn't kept a backup of their private key and taken reasonable precautions?
Today, the RavenBit project has been abandoned, but it may offer an interesting lesson for the industry: We need more advanced technology to make Bitcoin a tangible reality.
Opendimes
To circumvent the aforementioned issue of trusting the mint—whether a major mint or a small workshop—hardware signature generator manufacturer CoinKite designed Opendime, a microcomputer specifically designed to become a bearer Bitcoin asset. CoinKite co-founder NVK, reflecting on his motivation for starting the business, told Bitcoin Magazine, “Bitcoin is an electronic currency. We can only make a physical backup. Maybe one day, someone will discover a way to manually calculate secp256k1.” This means that, at least for now, you always need some kind of computer to generate valid Bitcoin keys; this computer (the one you use to generate the keys) is the mint.
OpenDime is designed around this fundamental fact. It has a computer chip that generates a public-private key pair and can securely store the private key behind a silicon-based tamper-proof mechanism.
At startup, the user must feed in a file or some other input to provide entropy; the chip uses this in part to generate Bitcoin wallets; this further ensures that the random number generation logic (which is open source) has better entropy input when generating these Bitcoin keys.
After completing the initial setup, simply connect it to a computer (like connecting a USB drive), and you will be able to see the wallet's public key; the wallet's balance can be viewed on a block explorer website.
Users can then send Bitcoin to this OpenDime wallet. But what happens when they want to withdraw their Bitcoin? They have to puncture the circuit board to unlock a circuit and read the private key, but this leaves obvious traces of use.
Opendime represents a major technological breakthrough in Bitcoin's anonymous asset technology. Today, one Opendime sells for $20, slightly higher than the $13 it was worth in 2016. As a result, it has become a symbol, with artists embedding it in luxurious Bitcoin artworks , making it part of Bitcoin meme culture.
While $13 or $20 is very cheap for a hardware signature device, and the issue of trusting the mint is resolved by allowing users to deposit funds into the device themselves, the price and appearance are still far removed from cash. The $20 price alone is problematic. If Casascius takes a 20% premium for its minted coins, then one would need at least $100 worth of Bitcoin to justify purchasing Opendime hardware; as a form of currency, it exceeds the price of most everyday consumer goods.
Finally, while this hardcore cypherpunk USB drive looks cool, it doesn't tell users what's inside, so the various OpenDIME types are not interchangeable (they're not homogeneous), unlike cash. We need a cheaper and more interchangeable solution.
Satodime
Belgian hardware signature maker Satochip has taken the concept of OpenDime and transformed it into a more subtle form factor, creating an open-source Bitcoin wallet that looks like a bank card and has very similar features to OpenDime. It can generate Bitcoin public and private key pairs and can even sign transactions (depending on the version). Users can interact with it via a mobile app using NFC. Other form factors exist, such as rings and coins, but the chip inside is the same, and the functionality is identical.
The price of this Satochip hardware can be as low as €13 (depending on your bundled purchase), which is cheaper than Opendime, bringing it closer to everyday cash use, but not by much. Stochip cards are still intended to be very secure hardware signature devices, not everyday cash wallets. These powerful and miniature computer chips are not cheap, so it's unlikely that the price will be below $10 at present.
Too expensive? Basic limitations
So, how cheap do physical Bitcoin hardware items need to be for them to be commercially viable, or are they completely meaningless?
According to a Federal Reserve report , the cost of producing one dollar bill ranges from 4.1 cents to 11.3 cents. The smaller the denomination of the bill, the higher the percentage of cost; for example, 4.1% of the cost is spent on manufacturing a one-dollar bill.
| denomination | Variable printing costs |
|---|---|
| $1 and $2 | 4.1 cents each |
| $5 | 7.1 cents each |
| $10 | 6.8 cents each |
| $20 | 7.3 cents each |
| $50 | N/A |
| $100 | 11.3 cents each |
- The table above was added by the translator and is taken from the Federal Reserve website linked in the original text. -
This means that if you were to consider it as a check for 20,000 satoshis—roughly $16 in today's prices—the hardware cost would have to be less than $1. Most chips capable of running Bitcoin cryptography are that cheap, but one chip has demonstrated just how cheap it can be: the NXP NTAG X DNA chip.
This NXP chip, with its sticker-antenna form factor and only a few millimeters thick, can run various cryptographic primitives, such as ECDSA and elliptic curve operations. It can create private keys, sign documents, and even encrypt messages. However, despite its power, it does not include the cryptographic curve (secp256k1) used by Bitcoin, so it is inherently incapable of operating on Bitcoin.
However, this 2025 NTAG chip can be bought for $3, if you can find a seller. This demonstrates just how cheap a chip capable of performing cryptographic operations can be.
Dishearteningly, the world’s most widely used form of cash—the kind that can be bent and fit in a wallet—may be extremely dangerous for computer chips. This is a lesson NVK has learned from experience, having experimented with various forms of hardware for the Bitcoin bearer asset.
The closest we can find to the appearance of real cash is OfflineCash 's product: a beautiful, collectible set of Bitcoin-denominated banknotes with an NFC chip similar to NTAG. This chip stores a user-generated key, and the company then generates a second key on its servers, creating a 2-2 multi-signature wallet. This server key has a time lock, eventually downgrading the multi-signature address to a single-signature wallet, at which point the user can withdraw their Bitcoin. They attempted to approximate the trusted mint problem, but ultimately repeated the multi-mint problem. While their cash appearance is indeed very attractive.
Developing a Bitcoin-native NTAG chip would easily cost millions of dollars, and implementing Bitcoin cryptography in this way could lead to numerous bugs if the manufacturer wasn't an expert in the field. Furthermore, it would have to be open-source to ensure there were no backdoors.
Physical Bitcoin bearer assets have a more fundamental problem. Even if you can find a sufficiently cheap chip and make it look like a banknote, you still need an internet connection to verify its authenticity—that it actually contains Bitcoin—because this asset is inescapably electronic. This problem can be solved by directly trusting a mint that issues such a Bitcoin-denominated cash instrument and believing they will honor its face value, but this loses the ideal of self-custodial, trustworthy cash. While this might work in jurisdictions that welcome Bitcoin.
So while OfflineCash's creation of this Bitcoin banknote (with a bearer asset security chip, eliminating the risk of trusting a mint) is cool, we're not quite there yet. Moreover, it might be over-engineered, because nobody needs Bitcoin-denominated change right now; eventually everyone will use fiat currency. Perhaps one day, after hyper-Bitcoinization , this will change. NVK believes there's a solution better than paper money, at least for the foreseeable future, which is why Coinkite created Tapsigner.
Tapsigner
Tapsigner is built on the Coinkite Bitcoin NFC chip—a technology similar to NXP's X DNA NTAG chip, only potentially more powerful and therefore more expensive—and takes a card-like form factor with a secure chip. Payments can be made simply by bringing the chip close to an NFC device, and users can choose from various stylish designs. However, within the chip is a fully functional Bitcoin wallet capable of running SCEP256K1 cryptographic operations. This allows it to create Bitcoin keys, securely store private keys, internally sign transactions, and broadcast them via a companion phone; this phone also provides crucial visual assistance for users to verify transactions.
Tapsigner can be used as a bearer asset, but it may be better suited as a rechargeable hardware signer that can spend a certain amount of Bitcoin (like a credit card) to solve the problem of change, and can also make one-touch payments to wallets that support this already very popular feature (NFC).
With cards like Tapsigner (around $20 each), the issue of Bitcoin-denominated payments has returned to the old-school model of small-merchant adoption, and integration with mainstream business accounting and payment software is needed. Cashapp and Square are on this path.
(over)
