Evolution of Physical Bitcoin: From Casascius to Tapsigner

Written by Juan Galt

Compiled by Saoirse, Foresight News

Bitcoin's digital nature is its core advantage. With its programmable features, Bitcoin enables self-custody, making it significantly more difficult for assets to be stolen or seized. At the same time, its digital form allows for instant transfer, enabling global value movement and settlement in just minutes.

However, Bitcoin has also faced controversy due to its intangible nature. In its native form, Bitcoin cannot be touched or held in hand; people can only comprehend it through imagination and understanding, which has been a significant barrier to its widespread adoption. For over a decade, entrepreneurs and creators have continuously attempted to physicalize Bitcoin while preserving its core cash-like properties. Although no one has yet fully solved all the challenges, these efforts have yielded considerable results and given rise to many iconic physical products.

Image source: Stacks Bowers Galleries

The Casascius coin was first minted on September 6, 2011, when Bitcoin was trading at just $8. It is undoubtedly the most iconic physical Bitcoin collectible ever created, and since then, numerous imitations have emerged. The name derives from Mike Caldwell’s username on the Bitcointalk forum. Many design elements established by this coin have since become important references for a wide range of physical Bitcoin products.

A major challenge in physical Bitcoin adoption is the secure storage of private keys. Bitcoin is a native digital asset that operates using cryptographic key pairs; the private key, as confidential information, generates a corresponding public key through a specialized Bitcoin encryption algorithm. Mike Caldwell generated his private key using an offline device, printed it, and affixed it to a precious metal coin, likely destroying any digital backups of the key stored on his computer. He also publicly detailed his full set of security measures on his personal website for potential buyers to review.

The printed private key is covered with a tamper-evident sticker; once the sticker is removed, a distinct honeycomb pattern remains visible on the surface. Buyers can use this to determine whether the private key for cryptocurrency purchased from a third party has been previously accessed.

Private key management represents the greatest security risk in creating physical bitcoins. Casascius's solution relied on users' trust in the developer. At the time, Mike Caldwell operated with transparency and rigor, and he still maintains an excellent reputation today—users’ trust was well rewarded. Today, these collectibles command significant premium values beyond the intrinsic worth of Bitcoin itself and precious metals, providing holders with substantial returns.

In November 2013, Casascius coins were officially discontinued. The Financial Crimes Enforcement Network (FinCEN), a division of the U.S. Department of the Treasury, informed Mike Caldwell that minting physical bitcoins was classified as a money transmission business, requiring compliance with stringent regulations. Additionally, the centralized trust mechanism involved in private key generation made him a focal point for regulatory scrutiny.

One year after the discontinuation of Casascius coins, RavenBit was officially launched to address trust issues in physical Bitcoin minting and to decentralize the minting process. RavenBit closely resembles the Casascius coin in appearance, but it does not come preloaded with a private key, and the tamper-evident seal is unsealed at the time of manufacture. Users can generate their own key pair, attach it to the coin, and then apply the tamper-evident seal.

Theoretically, this design achieves decentralization of minting rights, representing a breakthrough. However, in practice, it has only led to a proliferation of individual minters with no brand recognition or credibility, and many of the office devices used to generate private keys may be infected with malware. When you receive a RavenBit from someone else, you have no way of knowing whether they retained a copy of the private key or implemented adequate security measures.

The RavenBit project has long since ceased operations, but it provided valuable insights for the entire industry: truly realizing the physicalization of Bitcoin requires more advanced technology.

To fully address the trust issues surrounding minting physical bitcoins in both centralized and decentralized scenarios, hardware wallet manufacturer Coinkite developed the Opendime. This is a compact hardware device specifically designed to hold Bitcoin bearer assets. In an interview with Bitcoin Magazine, Coinkite co-founder NVK discussed the product’s original intent: “Bitcoin is digital currency, and everything we do is simply creating a physical backup for it. Perhaps someday someone will manually break the secp256k1 algorithm, but for now, generating valid Bitcoin keys always requires a computer—computers are today’s ‘minting tools.’”

Opendimes is designed based on this core logic. The device contains a built-in chip that autonomously generates a public-private key pair and securely stores the private key using a silicon-based tamper-resistant structure.

When initializing the device, users must import a file or other form of random entropy; the chip combines this data to generate a Bitcoin wallet. This open-source random key generation logic, combined with high-quality entropy input, further enhances key security.

Connect the Opendime like a regular USB drive to your computer to view the wallet’s public key; account balances can be checked in real time on a blockchain explorer. Users can send Bitcoin to the device, but to withdraw funds, they must physically destroy it. This action activates the circuit to read the private key, while leaving clear visible signs of damage.

Opendimes represent a major breakthrough in bearer asset technology. Originally priced as low as $13 in 2016, its current unit price is approximately $20 due to inflation. It has also become an iconic product in the industry, with many artists incorporating it into high-end Bitcoin art, gradually establishing itself as a cultural symbol within the Bitcoin community.

For hardware wallets, a price range of $13 to $20 is not high, and the user-controlled deposit model effectively addresses trust issues in minting. However, its pricing and form factor still differ significantly from everyday cash. Considering only the hardware cost, the $20 threshold is not low. Referring to the approximately 20% premium of Casascius coins, an Opendime must contain at least $100 worth of Bitcoin to match its hardware cost and attain流通 value, making it unsuitable for most everyday small transactions.

In addition, although this USB drive-shaped device has a unique design, it cannot intuitively display internal asset information. Each device is unique and lacks the interchangeability of cash. As a result, the industry has recognized the need to develop lower-cost, more universal alternatives.

Belgian hardware wallet manufacturer Satochip has launched Satodime, an open-source product inspired by Opendimes’ concept, featuring a more user-friendly, card-like design. It offers similar core functionality to Opendimes, generating Bitcoin key pairs and supporting transaction signing on select models. Users can interact with the device via a mobile app using NFC technology. Satodime is also available in multiple form factors—including rings and physical coins—each incorporating the same chip and functionality.

In bulk purchases, the unit price of Satodime can be as low as €13, making it more affordable than Opendimes and bringing it closer to the standard of everyday cash usage—though a significant gap remains. Satodime is fundamentally a high-security hardware wallet, not designed as a medium for everyday cash circulation. The inherent high cost of these high-performance microchips makes it difficult for the product price to fall below the $10 threshold for the time being.

To achieve commercial viability, what level must the hardware cost of physical bitcoins be reduced to?

According to Federal Reserve data, the production cost of U.S. dollar banknotes ranges from 4.1 cents to 11.3 cents. The smaller the denomination, the higher the unit production cost, with $1 bills even resulting in a 4.1% manufacturing loss.

Based on this calculation, the hardware cost of a physical Bitcoin carrying 20,000 sats (approximately $16 at current prices) must be kept under $1. However, most chips currently capable of running Bitcoin’s cryptographic algorithm do not meet this cost requirement. Nevertheless, NXP’s NTAG X DNA chip has brought this possibility into view for the industry.

This chip features a thin sticker antenna design, only a few millimeters thick, and can run various encryption protocols including the Elliptic Curve Digital Signature Algorithm (ECDSA) and Elliptic Curve Cryptography (ECC), supporting key generation, transaction signing, and data encryption. However, it does not include the Bitcoin-specific secp256k1 elliptic curve and cannot natively run Bitcoin-related programs.

Even so, the fact that the 2025 NTAG chip costs approximately $3 per unit when in ample supply demonstrates significant potential for price reductions in crypto chips.

Unfortunately, the foldable paper bill format commonly used in daily life can damage sensitive chips. The Coinkite team personally verified this issue while developing hardware for Bitcoin bearer assets.

The product developed by OfflineCash is currently the solution that most closely resembles traditional paper currency. This Bitcoin-denominated banknote features an NTAG-series NFC chip that stores a key generated by the user, while the company retains a second key on its server, together forming a 2-of-2 multisignature wallet. The server-side key is time-locked; once it expires, the multisignature wallet converts into a single-signature wallet, allowing the user to withdraw their assets. This approach attempts to avoid the trust risks associated with traditional minting, yet ultimately introduces new challenges related to decentralized minting. Nonetheless, its paper-currency design is undeniably visually appealing and holds collectible value.

Developing an NTAG chip natively supporting Bitcoin's algorithm requires upfront investments of several million dollars. If the development team lacks expertise in cryptography, they are highly likely to introduce vulnerabilities when adapting Bitcoin's cryptographic protocols. Additionally, such chips must be fully open-source to ensure the absence of backdoors.

As a bearer asset, physical Bitcoin faces another fundamental challenge: even if a low-cost, paper-currency-like hardware载体 is created, because Bitcoin is inherently a digital asset, users must connect to the internet to verify whether the device actually contains real value.

While trusting the issuer and accepting the note's face value as redeemable can resolve verification issues, it contradicts Bitcoin’s original design principles of self-custody and trustless cash. Of course, in regions with a favorable regulatory environment, this model may still be implemented.

In summary, products like OfflineCash, which combine secure chips with the physical form of banknotes, although appealing in concept, still have a long way to go before large-scale adoption. Moreover, in today’s environment, such products are somewhat over-engineered—there is currently no Bitcoin change system in place, and consumers still receive fiat currency as change. Perhaps only in a future where Bitcoin is fully adopted will they truly realize their value.

Within foreseeable limits, Coinkite believes that card form factors are superior to paper bills, which is why the company developed Tapsigner.

Tapsigner features Coinkite's proprietary Bitcoin NFC chip, which matches the performance of NXP's NTAG X DNA but offers enhanced functionality at a relatively higher cost. The product adopts a familiar debit card form factor, incorporates a secure element chip, supports NFC tap-to-pay functionality, and is available in multiple design options.

The chip integrates a complete Bitcoin wallet function, featuring the secp256k1 cryptographic algorithm to generate and securely store private keys, and performs transaction signing internally. The signed transaction is then broadcast by a companion mobile device. The mobile app also allows users to verify transaction details, providing an additional layer of security.

Tapsigner can serve as an anonymous asset carrier, but it is better suited as a rechargeable hardware wallet. Like a regular bank card, it enables定向 payments of fixed amounts of Bitcoin, perfectly solving the change problem while remaining compatible with mainstream tap-to-pay functions.

Priced at approximately $20, this product has shifted the focus of Bitcoin payment development back to offline retail adoption and integration with the ecosystems of mainstream corporate finance and payment software, with platforms like Cash App and Square actively driving this progress.