The History and Future of Physical Bitcoin

Bitcoin Magazine

The History and Future of Physical Bitcoin

Bitcoin’s digital nature is the source of most of its advantages. Since it is programmable, it unlocks self-custody practices that can make theft and confiscation very difficult. Since it is digital, it can move at the speed of light, allowing movement of value and settlement across the globe in minutes. 

Nevertheless, Bitcoin has at times been criticized for being hard to grasp, literally. Bitcoin, in its natural state, can not be touched, can not be physically held; it can only be imagined and understood. To many people, that’s a significant barrier and one that has inspired quite a few attempts to bring the coin into meat space, but it is not easy. 

Entrepreneurs and artists alike, for well over a decade, have taken on the challenge of making Bitcoin physical in a way that retains its most valuable cash-like properties, and while nobody has entirely solved the problem, significant progress has been made, leaving a wonderful trail of artifacts along the way.

Casascius Coins

(Image by Stacks Bowers Galleries) 

Minted as early as September 6th, 2011, at a bitcoin price of barely $8 dollars, Casascius coins are without a doubt the most iconic physical Bitcoin artifacts in history, with many copycats since. Named after Mike Caldwell’s Bitcointalk forum nym, which appears to be an idiom for “call a spade a spade”, the Casascius coins developed many of the practices that other attempts at physical Bitcoin would innovate on over the years.

One problem with making Bitcoin physical is the handling of private key material. Since Bitcoin is digitally native, it can only live in a cryptographic private-public key pair, a secret that is used to generate a public key, with Bitcoin-compatible cryptography. In the case of the Casascius coin, Caldwell generated the private keys in an airgapped machine and printed them, gluing them to the iconic precious metal coins and then presumably destroyed the copy that could have been kept on his computer. He described the security precautions taken on his website for potential buyers to review.

The printed private key was then covered by specialized tamper-proof stickers, which, if removed, leave an obvious mark in a “honeycomb pattern”. Buyers of the coins could thus tell if the private keys in a Casascius coin had been exposed before purchase from a third-party vendor.

This key management issue is the biggest hazard in the creation of physical bitcoin, and one which, in the case of Caldwell, was dealt with by trusting him not to cheat. He was also very transparent and careful by the standards of the time. To this day, his reputation is strong if not legendary, so that trust was well placed by buyers who profited greatly from the collector’s value of the items, which to this day mark a premium on top of the bitcoin and precious metal values of the piece.

Casascius coins were discontinued in November 2013 after the Financial Crimes Enforcement Network (FinCEN), a branch of the Treasury Department, informed developer Mike Caldwell that minting physical bitcoins qualified him as a money transmitter business with heavy compliance requirements. The trust involved in generating the private keys may have been a centralizing element that put a target on his back. 

RavenBit Coins

A year after Casascius coins shut down, RavenBit launched, with an attempt at decentralizing the trusted minting problem of physical bitcoins. The RavenBit coins, very similar in form factor to Casascius, did not come with pre-generated keys; instead, they came with the tamper-proof sticker unpealed, such that the user could generate their own keypair, paste it to the coin and slap the tamper-proof sticker on top.

This, in a sense, decentralized the mint and, in theory, that is a breakthrough, but in practice, it just created a thousand trusted mints, without brands, without reputations, using office printers that probably had malware on them. If you got a RavenBit coin from someone, how could you know that the person who bought it and generated the private key in there didn’t keep a copy or take proper precautions?

To date, the RavenBit project has been abandoned, but it probably taught the industry an interesting lesson. To make Bitcoin physical, we need to go higher tech.  

Opendimes

To route around the trusted mint problem — both at the center and at the edges – of physical bitcoins, Coinkite, the hardware wallet maker, designed the Opendime, a tiny computer purpose-built to be a Bitcoin bearer asset. Looking back on what motivated him, NVK, co-founder of CoinKite, told Bitcoin Magazine that, “Bitcoin is digital money. All we can do is an analog backup. Maybe someone cracks doing secp256k1 by hand in the future.” Meaning that currently, you always need some kind of computer to generate valid Bitcoin keys; that computer is the mint.  

Opendimes were designed around this fundamental fact. They have a computer chip that can generate a private-public key pair and store the private key securely, behind a silicon tamper-proof mechanism. 

Users have to feed it a file or some kind of input for entropy during setup, which the chip uses in part to generate the Bitcoin wallet, this grants further assurance that the random generation logic, which is open source, has an even better entropy input in the generation of those bitcoin keys. 

The public key of the generated Opendime wallet can always be seen by connecting the device to a computer, as you would a normal USB stick; its balance is visible on a block explorer.

Users can then send bitcoin to the opendime, but if they want to withdraw BTC from it? They have to physically puncture the device, which unlocks a circuit to access the private key, but renders the device visibly unsealed. 

Opendimes represent a major breakthrough in bearer asset technology and go for about $20 dollars each today, rising in price slightly with inflation from a low of about $13 each in 2016. As a result, they have also achieved iconic status, with artists embedding them in premium Bitcoin art and making them into Bitcoin meme culture. 

While $13 to $20 dollars is very cheap for hardware wallets, and the trusted mint issue is effectively solved by letting users fill the device with their own coins, the price and form factor are still far away from cash. On a price basis alone, $20 dollars is a big ask. If Casascius charged about 20% markup for his coins, then Opendimes should hold at least $100 worth of Bitcoin inside to be worth the hardware, and for use as a currency, which prices out most every day purchases.

Finally, the badass cypherpunk USB stick form factor, while epic, does not visibly tell the user much about its contents, making each device effectively non-fungible with other Opendimes and thus not cash-like. A cheaper and probably more fungible alternative is needed. 

The Satodime

Taking the Opendime concept to a more friendly form factor, the Belgian hardware wallet manufacturer Satochip created an open source credit card-like Bitcoin wallet, which has very similar qualities to the Opendime. It can generate Bitcoin private-public key pairs, and depending on the version, can even sign transactions. Users can interact with it via phone apps that talk to the card via NFC. Other form factors are available as well, like rings and coins that contain the same chip and capabilities. 

The cost for Satochip hardware can be as low as 13 Euros, depending on the bulk purchases, which is cheaper than an Opendime, which gets us closer to everyday cash purchases, but not by that much. The Satochip cards are intended to be high-security hardware wallet devices anyway, not daily-use cash containers. And these powerful and small computer chips are not cheap, hence the price floor above $10 that seems so hard to break through, for now. 

Too Expensive? The Fundamental Limits

So, how cheap does physical Bitcoin hardware need to be to make business sense, if it can make sense at all? 

According to the Federal Reserve, it costs anywhere from 4.1 cents to 11.3 cents to produce U.S. dollars. The smaller the value, the more expensive it is, with $1 bills incurring a 4.1% loss in production costs. 

That means that to justify a 20,000 Satoshis bill — roughly $16 dollars at today’s prices — the hardware needs to cost well under a dollar. Most computer chips powerful enough to do Bitcoin cryptography are above that price target, but there is one chip that demonstrates what is possible, the NXP’s NTAG X DNA chip.

Available in sticker antenna form factor, a couple of millimeters thin, this NXP chip can handle a variety of cryptographic primitives, such as ECDSA and ECC. It can create secrets, sign them and even encrypt a message. However, while powerful, it does not include the Bitcoin cryptography curve, secp256k1, which means it can’t do Bitcoin things natively. 

Nevertheless, this 2025 generation NTAG can be purchased for roughly $3, if you can find any supply, demonstrating how low the price can go on a chip capable of performing cryptographic functions.

Sadly, the cash-like form factor most of the world is used to, with flexible bills that people can fold into their pocket, can be very damaging to computer chips, a fact that NVK says he learned from experience, as they experimented with Bitcoin bearer assets hardware. 

The closest anyone may have come to the cash-like format is the OfflineCash company, with a beautiful, collection-worthy set of Bitcoin-denominated bills that have an NTAG-style NFC chip, which stores a user-generated key, while the company generates a second key on their servers, to create a 2 of 2 multisignature wallet. The Server key is on a time lock, degrading the multisig address to a 1 of 1 wallet, from which the user can eventually withdraw the bitcoin. This tries to get around the trusted mint issue, but ends up just replicating the many mints problem. Though their cash-like form factor is undeniably gorgeous.

The costs of producing a Bitcoin native NTAG can easily hit a few million dollars, and implementing Bitcoin’s cryptography in this way can be fraught with errors if manufacturers are not experts on the topic. It would also need to be fully open source to guarantee that there are no backdoors. 

There’s one more fundamental problem with physical Bitcoin bearer assets. Even if you could get a cheap enough chip in a cash-like format, you would always need online access to verify its authenticity —that the cash is loaded with real bitcoin— since the asset is unavoidably digital. The problem could be solved by simply trusting an issuing mint of Bitcoin-denominated cash instruments, and believing in the face value of a redeemable bill, but that would miss the ideal of self-custodied, trusted cash. Though it probably would work in a friendly jurisdiction. 

So, while it would be cool to have physical Bitcoin bills like those created by OfflineCash Company with a bearer asset secure chip and not trusted mint risk, we are still a ways away. And it might actually be overkill today, since no one would have bitcoin-denominated change anyway, so you’d end up getting fiat cash back, but maybe one day, post-hyperbitcoinization. NVK does believe there’s a superior solution to the cash format, at least for the foreseeable future, which is why Coinkite created the Tapsigner. 

The Tapsigner

Built on the Coinkite Bitcoin NFC chip, a technology similar to the X DNA NTAG by NXP, though perhaps more powerful and thus more expensive, the Tapsigner comes in the familiar debit card form factor, with a secure element chip, NFC tap to pay and cool designs to choose from. Inside the chip, though, is a fully capable Bitcoin wallet, with scep256k1 cryptographic capabilities, letting it create Bitcoin keys, store the secret securely enough and sign transactions internally, to be broadcast by an accompanying phone, which serves as a critical visual aid for the user to verify transactions.

The Tapsigner can function as a bearer asset, but perhaps even better as a refillable hardware wallet that can spend specific amounts of bitcoin, like any credit card, resolving the issue of change, and enabling tap to pay to wallets that support the already popular feature.

With cards like the Tapsigner, which cost about $20 bucks, the problem of bitcoin-denominated payments returns to good old-fashioned retail adoption, and integration with major business accounting and payments software, which Cashapp and Square are blowing wide open. 

This post The History and Future of Physical Bitcoin first appeared on Bitcoin Magazine and is written by Juan Galt.