Rigid mailers with "Do Not Bend" stickers

We don't have one, but at some point we will move onto other folks waiting on the list and there might be price changes. Let me know if you run into any issues with an expired code.


There is a sliding scale. If we are temporarily down, you can "offline" verify and see that the multisig is still loaded (assuming you can get data from the chain). If we are permanently down then you need to wait until the expiration ("claim before") date printed on the note.

First deliveries are expected late August.

Good question -- in this case the exploiter can only access the notes they have in their physical possession. So they would be able to claim the funds off a note without cutting it, but that's about it. The key material that the server holds never lets you claim funds alone -- you always need the user key which is stored on the note.


This is only to reinforce that you need 0.018 BTC + some for mining fees (the 0.017 BTC was a typo we missed before going live) in order to load the note. The payment to us is only $49 or $499 per pack plus S&H and taxes if domestic and in certain states. If you continue through checkout you will see that only the $49 plus these other fees is charged.


In theory you could scan the note using another app (our open source app won't do this) to capture the user key as a backup. If you receive a note from an untrusted or unknown party and you want to keep it for a while (e.g. not cut and claim or spend like cash), then you should go through a re-key procedure so you are the only holder of the user private key.

@cygan thanks for the catch -- the ordering system we use here to gate is super limited. You should now be able to use the code again (let me know if not!).

We've just updated our homepage with an FAQ and more details on the security model of the Bitcoin Note and I thought it would be worth adding here:

• Security: https://offline.cash/pages/bitcoin-note-security-overview
• FAQ: https://offline.cash/pages/faq

Any feedback is appreciated, notably if anything is confusing/unclear.

Thanks for posting @cygan! I forgot too add here


@MoparMiningLLC has this exactly right. Expire means the multisig downgrades from 2-2 (user key on note, encrypted manufacturer key on note) to just the user key. This is important, as if you have not re-keyed the note at this time a previous holder can rush to spend from the script. If you store the cash for a while, you probably want to re-key. (if not loaded originally by someone trusted, e.g. family). If you hold in your (physical) wallet for spending soon, you're probably fine to leave the note as is.

We will very likely never make a larger note unless we change the security model; but we very much do want to make smaller notes over time.


Our hope is that our model gives you a different trust model than previous notes where the private key could note be rotated.

It depends on your trust model. If you receive a note fresh from a family member as a gift, you might not re-key. If you are going to spend the note right away, you probably won't re-key. If you plan to claim funds off the note by cutting it soon you might not re-key. There are a bunch of scenarios where you may opt not to re-key and just spend like cash. We suspect gifting from a trusted party is going to be one of the most common cases near term, hence folks won't be re-keying frequently.

Most physical storage similar to this can't be re-keyed at all. Your options are, claim right away or trust the person who gave it to you (into perpetuity or until you will claim).


It does require sending funds to a new multisig -- we are recommending/defaulting to really low fees since given the notes are long lived it doesn't make sense that bills need to be loaded within a few blocks.

Thank you -- we have to start somewhere and we believe collectable -> gifting -> mainstream is the right path. The first edition will get low serial numbers as at least one point of distinction. But yes, we would really like to do some much larger production runs of bills (ideally millions).


Great! Stay tuned for the order notification email and drop me a line when it comes through. I'm just cameron [at] offline [dot] cash

That's really good to know, makes complete sense. We can probably coordinate something behind the scenes if multiple folks are in line.

Thanks! The apps will implicitly authenticate the notes with us (although, of course, that's trusting us) and we're investigating making them capable of auditing the multisig independently from us. In either case we hope that open sourcing the apps means that folks have an alternative means of verifying the multisig and how the apps function if so desired.

Yes, definitely -- the UX of the app is really important in helping less technical users understand the notes and their limitations.

We don't have pricing ready just yet, but think somewhere around a set of Opendimes. Limited production runs right now mean we don't get great volume discounts, but these notes will be low serial number (if that matters).

We probably will let folks order more than one set, but can't confirm that just yet.

> maybe I dont understand the answers above - but what happens on Jan 4 2029 to any of the notes should they still be loaded?

On January 3 2029 the multisig downgrades from 2-of-2 to 1-of-2 where the only key that can spend the funds is the user key on the note. If you're the last holder and you didn't re-key the note, it's probable that someone else also has a copy of the key (hence why we recommend re-keying when you receive a note).

Thanks for the feedback. Expiration is indeed a weird concept here -- maybe there is a better word. On the notes it states "Claim Before Jan 3 2029" as a warning, with the goal of indicating to a holder that *something* should be done before that date if they haven't re-keyed the note.

> Is this going to work with lightning? The Bold Card for example uses NFC and allows lightning transaction by just tapping it.

We designed these to be long-lived with few transactions throughout their life. We thought about Lightning but decided to start first with vanilla Bitcoin. As a payment instrument that you pass from person to person, on-chain transactions should be fairly minimal (unless you want to re-key the note). The Bold Card makes way more sense for frequent on-chain transactions, e.g. like a debit or credit card.

> Also, is there any open source app, library, or standard that can be used to confirm that the bill actually holds the funds it says it has? Of course it can have a public address, but that doesn't mean it has control over it. Not sure if it's possible to prove this. I guess something like this is critical for mass usage of this type of thing.

Given knowledge of the redeem script and the public keys which are plaintext on the note you should be able verify the address.

> How exactly does your chip change the multisig configuration when the expiration date is reached?

The script is created from a template when the first user loads the note; we are using OP_CHECKLOCKTIMEVERIFY to modify the conditions of the multisig from 2-of-2 to 1-of-2 in 2029. When you re-key the user key you are really sending from the first multisig to a new one. We're going to release the script for review prior to note shipment as well as have a more detailed article on security.

> Will you open source / peer review your technology?

The script and mobile app will both be fully open sourced for review.

> Will these items get redeemed only after expiration or by destroying them?

Exactly; those are the only two conditions where you can redeem. "Cutting" doesn't require slicing the whole note in half, only a portion of it.

> What I don't understand is that each note has an expiration date, so does this mean that bitcoin can't be used or what?

Yeah, this is a great question. We needed to have a condition where the multisig reverts from 2-of-2 (the user key on the note and the encrypted key on the note) to 1-of-2 in the case where we go out of business or simply refuse to release the encryption key. This happens after the expiration date. It's a bit of weird concept, but we always want to make sure you retain ultimate control over the Bitcoin.

Hello --

Excited to show off something that we've been working on: the Bitcoin Note. The Bitcoin Note is a cash instrument that is backed by Bitcoin via multisig. Each note is printed with beautiful, currency-grade elements that use secure printing techniques typically reserved for government documents like microtext, raised print and foil. More importantly, each note includes a secure NFC chip which is where a multisig lives that allows you to claim the Bitcoin at any time.

We were heavily inspired by OG Bitcoin physical money like Casascius coins, however, we wanted to created a design whereby (1) anyone can spend, gift and share the Bitcoin for years to come without having to worry a sophisticated attacker who extracts a private key from under a label or scratch off and (2) trust was minimized on that part of the printer (us).

This lead us to the design we landed on for the Bitcoin Note --

• An NFC chip readable by nearly all modern smartphones
• A two part multisig where (1) we write an encrypted private key to the note (and don't keep a copy and (2) you write a user key to the note in plaintext and then load the note
• We only release the decryption key when someone cuts the note and reports this via an authenticated and encrypted way to our server
• The multisig reverts to only your key after a printed expiration date on the note
• You can re-key the user key on the note you receive if you want to hold it for a long time

The result is you do not need to trust us as the creators of the note. While, as I noted, we do not keep a copy of the encrypted private key this doesn't really matter: by the construction of the multisig, this key can never access the funds alone. Likewise, the expiration date means that even if we aren't around or refuse to allow for the claiming of a note by cutting it, the holder can wait and then use the user private key to claim.

We believe that the result of this design achieves the goal of Bitcoin that's incredibly easy to use -- like cash -- but still preserves the important quality of self-custody. Take a look at http://bitcoinnote.com/ to learn more and reserve a spot in line for our release later this summer. Any and all feedback is appreciated and I would be happy to answer any questions.