Wallet Logo

Casascius Coins

🔍 Last analysed 23rd March 2022 . Leaks Keys Not functioning anymore
17th December 2011
27th November 2013

Jump to verdict 

Do your own research!

Try out searching for "lost bitcoins", "stole my money" or "scammers" together with the wallet's name, even if you think the wallet is generally trustworthy. For all the bigger wallets you will find accusations. Make sure you understand why they were made and if you are comfortable with the provider's reaction.

If you find something we should include, you can create an issue or edit this analysis yourself and create a merge request for your changes.

What is a bearer token?

Bearer tokens are meant to be passed on from one user to another similar to cash or a banking check. Unlike hardware wallets, this comes with an enormous "supply chain" risk if the token gets handed from user to user anonymously - all bearer past and present have plausible deniability if the funds move. We used to categorize bearer tokens as hardware wallets, but decided that they deserved an altogether different category. Generally, bearer tokens require these attributes:

  • Secure initial setup
  • Tamper evidence
  • Balance check without revealing private keys
  • Small size
  • Low unit price
and either of these applies:
  • Somebody has a backup and needs to be trusted.
  • Nobody has a backup and funds are destroyed if the token is lost or damaged.

The Analysis 

Background

The idea of physical coins that contain bitcoins was the brainchild of Mike Caldwell, a software engineer from Utah. The coins come in different BTC denominations: 1, 10, 25, 100 and 1000. The physical bitcoins grew in popularity because of their tangible nature. They were first announced in the bitcointalk.org forum on September 6, 2011. Embedded in each physical coin is a 30-character string representing the private key. This was covered by a tamper-resistant hologram.

Caldwell has since stopped selling the coins on November 27, 2013 due to FinCen notices and other regulatory concerns. However, it is still possible to track how many Casascius coins in circulation have not been redeemed via this website.

Notes: the inception of physical bitcoins with embedded private keys had a vital weakness: trust. The people who bought the Casascius coins hinged the value of the coins by trusting Mike Caldwell who printed the private keys. Fast forward to the future, and an innovation to this is the 2FKG (2 Factor Key Generation) process pioneered by BalletCrypto. This created a system where the buyer generates a part of the secret, unknowable to the provider.

To resolve these trust issues, Caldwell introduced something similar which he called the Physical Bitcoin Key Generator on December 16, 2012. He announced this via Bitcointalk.

I am in the process of releasing a free generator that prints an unlimited supply of key circles in the format pictured below. It prints 96 to a page.

I plan on also lowering my price on quantity 500+ of my token blanks, of course these don’t come with key circles anymore, because you’ll print them yourself.

All you need is your own holograms, and a 3/8” holepunch to knock the circles out of the paper in perfectly cut fashion.

Although novel at the time, the vulnerability to printing your own private key and just buying blank tokens is in the printing process itself. Printers are known to store memory of the thing printed on the printer itself. A hacker who has managed to penetrate the system of a user has the potential to access this especially if the printer is shared or a networked device.

(dg)

Verdict Explained

This product requires sharing private key material!

As part of our Methodology, we ask:

Leaks Keys!

Does the device hide your keys from other devices?

If the answer is "no", we mark it as "Leaks Keys".

Some people claim their paper wallet is a hardware wallet. Others use RFID chips with the private keys on them. A very crucial drawback of those systems is that in order to send a transaction, the private key has to be brought onto a different system that doesn’t necessarily share all the desired aspects of a hardware wallet.

Paper wallets need to be printed, exposing the keys to the PC and the printer even before sending funds to it.

Simple RFID based devices can’t sign transactions - they share the keys with whoever asked to use them for whatever they please.

There are even products that are perfectly capable of working in an air-gapped fashion but they still expose the keys to connected devices.

This verdict is reserved for key leakage under normal operation and does not apply to devices where a hack is known to be possible with special hardware.

But we also ask:

Defunct!

Is the product still supported by the still existing provider?

If the answer is "no", we mark it as "Not functioning anymore".

Discontinued products or worse, products of providers that are not active anymore, are problematic, especially if they were not formerly reproducible and well audited to be self-custodial following open standards. If the provider hasn’t answered inquiries for a year but their server is still running or similar circumstances might get this verdict, too.