Quantum money, without the quantum computer

In 1983, Stephen Wiesner described a banknote that could not be counterfeited — not because a bank vouched for it, but because copying it was physically impossible. Each note carried a set of quantum states, and the no-cloning theorem says an unknown quantum state cannot be duplicated. Anyone holding the note could verify it. Nobody could forge it. No issuer needed to be online, and no register of who owns what had to exist.

That is a strikingly complete description of cash. It is also a strikingly complete description of what blockchains have spent fifteen years trying to approximate with software.

Quantum money never shipped for a boring reason: it requires quantum memory that holds coherence for as long as you intend to hold the money. Weeks. Years. That hardware does not exist and is not close. So the idea sat in the literature as the thing everyone agreed would be ideal and nobody could build.

Digital information is trivially copyable. Send someone a file and you still have the file. Applied to money, that is the double-spend problem, and every system that has solved it has solved it the same way: keep an authoritative record of who owns what, and route every transfer through whoever maintains it.

A bank does this centrally. Bitcoin decentralised the record but did not remove it — it replicated the bookkeeping across a network of nodes, then added Nakamoto consensus so those nodes agree on which copy is real. Ethereum and Solana extended the same shape from payments to programs, with validators executing state transitions and a Byzantine fault tolerant protocol reconciling the result.

The replication is what you pay for, and the bill is itemised:

• —Throughput. Every node holds the whole chain. Bitcoin lands near seven transactions per second; Ethereum near one hundred. Rollups help, but inherit the settlement layer’s ceiling.
• —Finality. Bitcoin can take an hour to be confident. Ethereum and its scaling layers still measure finality in seconds to minutes.
• —Cost. A transaction validated by a global network is priced like a transaction validated by a global network.
• —Subsidy. Miners and validators are paid in token inflation. That subsidy is not permanent, and when it thins, fees thicken.
• —Privacy. Broadcasting every transaction to everyone is not a side effect of the design. It is the design.

Physical cash has none of these problems. Two people transact, it settles instantly, it costs nothing, it runs in parallel with every other pair of people on earth, and nobody else learns about it. Its only real defect is that it is physical, so it cannot cross a network.

Shift takes Wiesner’s requirement — money that cannot be copied and can be checked locally — and asks what else could enforce it. The answer it lands on is not quantum states but a minimal secure chip with two capabilities that ordinary hardware wallets do not have.

1. Key encumbrance

A hardware wallet like a Ledger already generates keys inside a secure element and signs without ever exposing them. Shift’s hardware adds one step: the instant a transaction is signed, the device irreversibly encumbers that signing key so it can never sign anything again. Keys are strictly single-use. Any change from a spend goes to a fresh address.

The double-spend problem dissolves at that point. The money is not tracked as a balance somebody could spend twice — it is bound to a key that has already burned itself.

2. Remote attestation

Encumbrance only helps if the recipient knows it happened. So each device produces an attestation report proving its identity and integrity, including proof that the key was encumbered. Devices verify each other’s reports directly. The sender first checks that the recipient’s address was generated inside a device with the same property, which is what makes the guarantee cascade: money can only ever move into hardware that will in turn enforce single use.

The chip is deliberately austere. Shift does not want a general-purpose trusted execution environment such as Intel SGX, whose broad feature surface has produced a long history of side-channel breaks. A device that can do five things well has a much smaller attack surface than one that can do everything adequately.

Five steps, two devices, nobody else. There is no mempool to wait in and no block to be included in.

• —Address verification. The sender asks the recipient for an address plus an attestation report proving that address was generated inside a compliant device.
• —Signing. The sender’s device validates the report, then signs the transfer with the key controlling the funds.
• —Encumbrance. The device immediately and irreversibly encumbers that key. It will never sign again. Change goes to a fresh address.
• —Attestation. The hardware emits a report proving its integrity and the fact of encumbrance.
• —Peer verification. The recipient’s hardware verifies the report and accepts the transaction as final. Final meaning final — there is no reorganisation to wait out.

The rightmost column is why the comparison is worth making at all. Shift is not competing with blockchains on their own terms; it is trying to occupy the slot quantum money was supposed to fill, using hardware that can actually be manufactured.

Any argument that leans on hardware inherits the hardware’s weaknesses, and it is worth being precise about them.

• —This is not quantum cryptography. Shift uses classical secure elements. Quantum-based approaches, such as quantum one-time memories, appear in the whitepaper only as a possible five-year-plus direction.
• —The threat model assumes the attacker owns the device. Because every user holds their own hardware, Shift must survive software attacks, side channels, fault injection, NAND mirroring and hardware trojans — with no data-centre perimeter to hide behind.
• —Attestation key extraction is the real attack. Pull that key and you can impersonate honest hardware. Shift’s mitigations are PUF-derived keys, hardware masking and circuit redundancy, plus a hardened protocol variant that publishes transaction references to a public bulletin board so that money minted from nothing has no provenance to point at and gets caught.
• —The hardware does not fully exist yet. The whitepaper says so plainly. The roadmap runs from hardened closed-source chips in years one to three, to verifiable open-source chips in years three to five, to non-destructive chip verification beyond that. Prototypes are built modularly so weaker hardware can be swapped for stronger.

Stating this is not a hedge. A system whose security rests on physics has to be honest about which physics is available this decade.