The Promise and Regulatory Challenge of “Physical” Bitcoins

Physical bitcoins that can be exchanged like cash have been discussed for years. In 2010, Gavin Andresen himself started a Bitcoin Forum discussion on possible ways to “print out bitcoins to function as user-created paper money.” Physical bitcoins have been often implemented, but there are several challenges. Many physical bitcoin operators active a few years ago have either disappeared or don’t show signs of recent activity. Others are just novelty collectibles that don’t store actual bitcoins. But there are still some interesting options both on the horizon and on the market in the physical bitcoin space.

Physical bitcoins are a real killer app for many reasons, first and foremost because they can be exchanged privately and anonymously without leaving any trace whatsoever, just like cash. Of course, this is exactly the reason regulators hate the idea and will do anything to stop physical bitcoins from spreading. Also, designing physical bitcoins with both high security and high usability is difficult.

In an ideal world, simple paper wallets could be used as physical bitcoins. In fact, anyone can make a paper wallet, load it with any amount of BTC, print it out and give it to anyone. The recipient can easily check the balance before accepting the paper wallet and folding it in their physical wallet for further use, just like cash.

Of course, in the real world the chain will be broken very soon. Since both the public and the private keys are nicely printed on a paper wallet, anyone can empty the paper wallet after having passed it on. This forces the very first recipient to empty the wallet themselves immediately after receiving it, but then the transaction isn’t more private than a normal bitcoin transaction between the first and the second (last) owner.

It’s worth noting, in passing, that this simple chain of trust would only work among people who really trust each other. For example, members of a closed club with strong entry vetting could use bitcoin paper wallets as internal currency for goods and services exchanged within the club.

In practice, physical bitcoins must have private keys (or equivalent) hidden in a tamper-proof way. One possibility is to use scratch cards like Crypto Scratch Cards (now discontinued). One of the first attempts at developing physical bitcoins, dubbed Bitbills, announced in May 2011, used a credit card-like form with an anti-counterfeiting hologram and a QR code embedded within the card, which could not be read without the card showing evidence of tampering. The project was abandoned a few months after being announced.

Another possibility is to manufacture physical bitcoins with the public key visible on the outside, but the private key (or equivalent) hidden inside or by a tamper-evident seal. This method was used by late lamented Casascius Physical Bitcoins, which were discontinued in November 2013 after the Financial Crimes Enforcement Network (FinCEN), a branch of the Treasury Department, informed developer Mike Caldwell that minting physical bitcoins qualified him as a money transmitter business with heavy compliance requirements.

Today, there are a few options that seems to have worked out most of these difficulties.

The physical bitcoins sold by Denarium, headquartered in Finland, have a private key inside the coin and use a hologram as an anti-counterfeiting measure. “The hologram has a ‘window’ where a portion of the public Bitcoin address of the coin can be read for checking balance and loading bitcoins to the coin,” states the Denarium website. Denarium coins come in two versions, one loaded with a predefined amount, and an “empty” version that must be loaded by the users themselves by sending bitcoins to the coin’s address. Due to regulations, only empty coins can be sold to U.S. residents.

All Denarium coins, including pre-loaded ones, can be reloaded by sending bitcoins to the coin’s address. A Denarium coin can be redeemed “by opening the hologram sticker and importing the private key underneath to the wallet of your choice,” reads the Denarium user guide. “Please note that an opened hologram sticker implies that the coin has been spent. The hologram sticker cannot be put back after opening so it should not be removed without the intent to spend the bitcoins.”

Opendime, a tiny USB flash drive that can be loaded with bitcoin by the first user and passed along, is more of a light hardware wallet than a heavy paper wallet. Unlike most other options, the private key attached to each Opendime is generated by the device at the time of setup by the user: It is not known by anyone, not even by the first owner. Opendimes can be passed along multiple times to other users and verified; however, it can only be redeemed by the last user, who must break the device to access the private key and import it into any bitcoin wallet.

A pack of three Opendimes can be ordered for $37.50. Though perhaps too technically demanding for casual Bitcoin users and too expensive for small values (the device is useless after getting the funds out), Opendimes are certainly usable as physical bitcoins.

Earlier this month Fintech Select, a provider of prepaid card programs, mobile banking solutions, announced that it will be launching a test pilot project for physical bitcoins associated with the company’s Selectcoin product line.

Another interesting idea, which has been discussed a few times on Bitcoin Forum (e.g. 1, 2, 3), is that of “hijacking” physical banknotes to carry a value in bitcoin. A physical bill (say a $1 bill) identified by a serial number would be assigned a value in bitcoin (say 0.1 BTC) and used as a physical bitcoin bill, with robust anti-counterfeiting measures automatically provided courtesy of the state.

The idea was presented in a recent tweet by Andreas Antonopoulos. Cryptographer and Bitcoin developer Sergio Demian Lerner replied: “Not a bad idea: I proposed this seriously in 2013.”

“I found one of those powerful ideas that are so simple, but so odd at first sight, that can go unnoticed,” said Lerner in his 2013 post, inspired by a Bitcoin Forum discussion. “The idea is that people could use fiat banknotes as a medium to transfer bitcoins, for offline Bitcoin payments.”

Binding a value in bitcoin to the serial number of a banknote, in such a way as to permit the last bearer to redeem it, seems impossible to do in a watertight and decentralized way, but perhaps a central operator could implement a similar scheme.

Lerner’s solution is simpler: “[If] we transfer some BTC to a [unspendable] output which describes the banknote (e.g. country, denomination and serial number), we could bind the BTC to the banknote forever, as long as people believe the banknote represents those ‘destroyed’ BTC,” he said. “[For] the system to work, everyone must agree that those BitBanknotes really hold the BTC value. But you can count on me: I would agree! Why not?”

Lerner’s own project to develop physical bitcoins, dubbed “Firmcoin,” seems to have disappeared. But it’s plausible that new implementations of untraceable electronic cash, powered by strong cryptography and NFC-enabled smartphone apps, could resurface at any time to pose a very strong challenge to state monopolies and regulators.