In 1995, two people could insert their smart cards into a pocket wallet and move money face-to-face, offline, without asking a bank or writing the payment to a central ledger. A British high-street bank shipped it. This is the story of why it died — and why central banks and crypto companies are now rebuilding it from opposite directions.
On 3 July 1995, a 72-year-old newspaper vendor named Don Stanley made the first live Mondex sale in Swindon town centre.
It looked like a card payment. Architecturally, it was almost the opposite.
With a debit card, the card proves who may ask a bank to move money. With Mondex, the value itself lived on the chip. The payment did not need per-transaction bank authorisation. A customer could pay at shops, car parks and BT payphones, or insert two cards into a pocket Mondex Wallet and transfer value directly from one purse to another.
The card was not merely a credential for accessing the money.
The card was the money. Consult Hyperion
The rollout was fast enough to look like the future. Five weeks after launch, roughly 6,000 people were using Mondex across 620 retail locations equipped with about 1,900 terminals. But the curve flattened. By the end, only around 14,000 cards had been issued, far short of the 40,000 users the trial had hoped to attract, and actual usage remained thin. Swindon never became a national rollout. Mastercard absorbed Mondex, and the product survived in scattered pilots without becoming ordinary money. Wikipedia
An entire continent tried this
Mondex was not an isolated experiment. Europe spent the 1990s filling smartcards with small amounts of money.
Finland launched Avant in 1993. Because it was initiated, developed and initially operated by the Bank of Finland, the central bank itself now describes it as the first CBDC — two decades before anyone used the acronym. Denmark had Danmønt. Belgium had Proton. The Netherlands had Chipknip. Germany had GeldKarte.
Most eventually disappeared as conventional debit cards became cheaper, more widely accepted and easier to use. Bank of Finland Publications
Hong Kong’s Octopus became the most successful surviving descendant. A standard Octopus can still be transferable, usable by anyone and unlinked to a verified identity, while the system operates partly offline for speed. But Octopus evolved primarily into a transport and retail payment network, not a general-purpose purse-to-purse replacement for cash. Octopus
There was also a second, more cryptographic branch of the family.
In 1982, David Chaum described blind signatures: a way for a bank to sign a digital coin without seeing the coin’s serial number. The user blinds the coin, the bank signs the hidden version, and the user removes the blinding while preserving the signature. When that coin is later spent, the bank can verify that it authorised the withdrawal but cannot connect the payment to the person who withdrew it.
That is not privacy by company policy. It is unlinkability built into the protocol. Springer Link
Chaum’s company DigiCash deployed a version of this idea as online ecash. European research projects such as CAFE explored putting related designs into smartcard wallets. But DigiCash went bankrupt in 1998, and the cryptographic branch never reached anything like mass-market scale. European Commission
Unaccounted, not untraceable
The folklore around Mondex often upgrades it into perfect anonymous cash. That is not quite what it was.
Mondex payments were unaccounted, in the sense that no central system necessarily recorded and authorised every transaction as it happened. They were not fully untraceable.
A purse retained its ten most recent transactions. Merchant terminals could retain records of hundreds of payments, including the card identifier, amount and timestamp. The issuer could associate a card identifier with the person to whom the card had been issued.
Mondex’s privacy was therefore operational and architectural: payments could happen without immediately passing through a central database. It was not the cryptographic unlinkability Chaum had designed. Roger Clarke
The two branches had opposite strengths. Mondex reached real users with weaker privacy. Chaumian ecash offered stronger privacy and reached almost no one.
Neither survived the decade in the form its inventors imagined.
It died commercially before it could fail cryptographically
The first thing that killed Mondex was not a broken chip. It was the economics of an empty network.
Banks had to issue and load a new kind of card. Merchants had to install dedicated terminals. Consumers had to open or connect an account, wait for the card, preload it and remember how much value remained on it. Yet they already had cash, and increasingly they had debit cards that worked in more places.
Mondex’s peer-to-peer payments were designed to carry no transaction charge. That was attractive to users and some merchants, but it left limited revenue with which to subsidise a new hardware network. Every side was waiting for the other sides to make the system useful first. Fourteen thousand cards could not justify a town full of terminals any more than a town full of terminals could create forty thousand committed users. Consult Hyperion
Then money moved onto the internet.
Mondex did contemplate online payments, but the proposal required specialised readers attached to both parties’ computers. The web rewarded credentials that could travel through a browser, not monetary value that had to travel through a physical reader. Card-not-present rails inherited the internet. The chip purse remained a local appliance. Roger Clarke
The third force arrived mostly after Mondex had already failed: the anti-money-laundering ratchet.
It did not kill the Swindon trial. It narrowed the space in which anything like it could later return.
European law progressively reduced the customer-identification exemptions available to low-risk electronic-money and prepaid products. The general threshold fell from €250 to €150, while remote payments above €50 no longer qualified for the exemption. These were not universal legal limits on anonymous money, but the direction of travel was clear: anonymous electronic value was increasingly treated as a compliance exception rather than a normal form of cash. EUR-Lex
The same direction now reaches crypto. From 10 July 2027, the EU’s new anti-money-laundering framework will prohibit regulated crypto-asset service providers from maintaining anonymous or anonymity-enhancing accounts, including through assets with built-in anonymity features. The regulation distinguishes those custodial services from self-hosted wallet software and hardware whose providers do not control the assets, but the message for regulated intermediaries is unmistakable. EUR-Lex
The first two forces killed Mondex. The third killed much of its possible afterlife.
None of them gave its deepest security assumption time to fail in public.
The flaw underneath
Suppose the economics had worked. Suppose every computer had shipped with a smartcard reader. Suppose regulators had protected small anonymous payments as a normal civil liberty.
Mondex would still have carried a structural risk.
When monetary value is stored and conserved locally inside tamper-resistant devices, the soundness of the currency depends on those devices correctly enforcing every debit and credit. There is no global ledger consulted at the moment of payment. The receiving terminal trusts the two chips to have performed the transfer honestly.
A broken purse was not automatically an unlimited printing press. Extracting one user’s key did not necessarily reveal system-wide secrets. But an attacker who could defeat the balance-decrement logic, clone and restore purse state, forge accepted value or recover reusable scheme secrets might spend the same stored value repeatedly.
And because the vulnerability would be repeatable, it could scale like software. Roger Clarke
Ross Anderson and Markus Kuhn were publishing warnings about exactly this class of assumption in the mid-1990s. Electronic purses were being built on processors marketed as tamper-resistant, while researchers were demonstrating that smartcards could be attacked through voltage glitches, clock manipulation, probing, fault injection and key extraction. Their conclusion was not that secure hardware was useless. It was that systems should be designed around the possibility that some supposedly tamper-resistant devices would eventually break. Computer Laboratory
Mondex had logs, balance limits and eventual interactions with banks. Suspicious value might therefore surface later, during merchant uploads or forensic investigation. But the scheme had no universal reconciliation point through which every payment had to pass before becoming final. Detection could lag behind circulation.
Paper cash has a similar bearer structure, but its failure mode contains physical friction. Every counterfeit note has to be manufactured, transported and passed. It can be inspected and removed one object at a time.
A reusable electronic-purse exploit scales through copying.
Paper counterfeiting scales through manufacturing and distribution. A purse exploit can scale like a software release.
That is the flaw underneath bearer hardware money: a local engineering failure can become a monetary event before the monetary system knows anything happened.
The inversion
Bitcoin inverted the design.
Instead of keeping monetary truth inside the object held by the user, Bitcoin moved it onto a replicated public ledger. A wallet does not contain bitcoin in the Mondex sense. It contains keys that authorise changes to a shared state.
The network checks whether the value exists, whether it has already been spent and whether the transaction obeys the issuance rules. Anyone running the software can independently verify those rules rather than trusting a private database or a retail chip to report the correct balance. Bitcoin
The price of that inversion is privacy.
At Bitcoin’s base layer, the transaction graph is public. Addresses are pseudonyms rather than legal names, but the movements between them can be observed, clustered and analysed indefinitely. Reusing addresses or connecting them to an identity makes the trail progressively easier to follow. Bitcoin Developer Documentation
Mondex hid most payments from the centre because there was no global ledger.
$Bitcoin protects the supply by showing the ledger to everyone.
Glass money: one property of cash recovered, another destroyed.
The synthesis — and its warning
The interesting synthesis is privacy-preserving ledger money.
$Zcash uses zero-knowledge proofs to validate shielded transfers without publicly revealing the participants or amounts. Monero reaches a different privacy point through ring signatures, stealth addresses and confidential amounts. The mechanisms differ, but the objective is related: preserve a shared monetary state without turning every payment into a public bank statement. Zcash Zips
On paper, that appears to recover both halves at once. Consensus can reject double-spends and enforce monetary rules, while cryptography conceals the details of individual transactions.
But the silent-mint story did not disappear. It moved.
In March 2018, Zcash engineers discovered a flaw in the proving system used by the original Sprout design. It could have allowed an attacker to create counterfeit shielded value without detection. The flaw was covertly removed when Sapling activated in October 2018 and publicly disclosed in February 2019. The team found no evidence that it had been exploited. Electric Coin Company
Then it happened again.
On 29 May 2026, a critical vulnerability was discovered in Zcash’s Orchard pool. It could have allowed an attacker to create an unlimited amount of counterfeit ZEC inside Orchard without the counterfeiting being visible. An emergency response closed the vulnerability on 2 June. But Orchard’s privacy properties also meant there was no cryptographic way to prove retrospectively that the bug had never been exploited. Zcash Community Forum
The response was instructive. Ironwood, activated on mainnet on 28 July 2026 at block 3,428,143, created a new shielded pool and stopped the old Orchard pool from accepting new outputs. Funds could leave Orchard only through an on-chain turnstile that tracks how much legitimate value had entered and prevents more from leaving than that amount.
Any hypothetical excess value could no longer escape into the active circulating supply. Zcash Community Forum
This is not a story in which mathematics defeated silicon and the problem went away.
It is a story in which the soundness risk moved from chip design into proving systems, circuits, consensus rules and implementation code. The system gained something Mondex never had: public boundaries capable of containing the damage. But zero-knowledge did not make engineering disappear.
The lesson is not math good, hardware bad.
The lesson is that every hidden-value system needs an externally enforceable boundary around what may enter, what may leave and how a failure can be contained.
Everyone is rebuilding Swindon
The smartcards are now returning from two directions.
Central banks are rebuilding offline digital cash.
The planned digital euro includes proximity payments in which two devices exchange value through NFC without an internet connection. The ECB’s twelve-month pilot is scheduled to begin in the second half of 2027 and will test both online and offline person-to-person and merchant payments. For offline transactions, the design places payment processing and balances inside a secure element, with ECB-provided software responsible for preventing double-spending. European Central Bank
The ECB describes offline payments as offering cash-like privacy: personal transaction details would be known only to the payer and payee. Holding limits will exist, although the final amount has not been decided; simulations requested during the legislative process tested possible limits between €500 and €3,000. European Central Bank
China is experimenting with the same physical frontier. Its e-CNY programme includes hardware wallets embedded in SIM cards and other devices, allowing value to be used through NFC in supported regions. Beijing Government Website
The Bank for International Settlements has approached the problem from the cryptographic branch. Project Tourbillon built CBDC prototypes derived from Chaumian ecash, using blind signatures to provide payer anonymity while still allowing the central bank to observe aggregate issuance and redemption. David Chaum served as a technical adviser, forty-one years after his original paper. Bank for International Settlements
And Chaumian cash finally has a live fiat deployment. GNU Taler 1.0 launched as a Swiss-franc public beta in May 2025. Its protocol is designed to preserve payer privacy while making merchant income auditable. But Taler payments currently have to be performed online to prevent double-spending. It solves a different part of the problem from Mondex’s fully offline purse-to-purse transfer. GNU Taler
The dividing line is not simply central banks versus crypto, or policy versus mathematics.
It is the difference between guarantees enforced by publicly inspectable protocol constraints and properties that remain adjustable by an operator, issuer or legislature.
Blind signatures can make the link between withdrawal and payment unavailable to the issuer by construction. A privacy policy can promise that the issuer will not inspect data it technically possesses. Those are not equivalent guarantees.
But mathematical privacy is not invulnerability. The primitive still lives inside software, wallets, circuits, hardware and governance processes. A guarantee may be cryptographic at one layer and discretionary at another.
The useful question is therefore not, “Does this system use cryptography?”
It is: Which properties would remain true if the operator changed its mind?
The card becomes the key
Crypto companies are also rebuilding the card, with one inversion that changes the failure mode.
In the 1990s design, the card held the monetary state. Its internal balance was accepted as money.
In the modern design, the monetary state lives on a ledger and the card holds an authorisation key.
Compromise a Mondex-style purse’s value-conservation mechanism and the attacker may be able to create or repeatedly spend value that the wider system cannot immediately distinguish from legitimate money.
Compromise a modern hardware wallet and the attacker can steal the assets controlled by its keys. A supply-chain attack can affect many users, and the theft can still be catastrophic, but it does not normally permit the attacker to create new native currency. The ledger records the stolen transfers, and the monetary rules remain intact.
The failure changes category.
Hidden monetary inflation becomes visible theft from affected keys.
That is what tamper-resistant hardware is good for: reducing the chance that an authorisation secret can be extracted or misused. It can be one security boundary inside a larger system. It should not be the only place where the existence and conservation of money are defined.
Physical crypto objects designed to circulate like banknotes complicate the distinction. If ownership is transferred by handing over a card, stick or sealed key, the recipient must trust that the previous holder did not copy the secret first.
Those objects re-import Mondex’s custody assumption: that the physical object represents a unique claim.
They do not necessarily re-import Mondex’s monetary-soundness assumption. A copied Bitcoin key can steal or double-spend the balance associated with that key. It cannot mint additional bitcoin that consensus accepts.
The distinction matters.
One failure threatens the bearer object.
The other threatens the currency.
What is still missing
Physical cash bundles several properties that digital systems keep pulling apart.
It offers intuitive bearer custody. It enables immediate face-to-face payment. It reveals little by default. A person can inspect a note locally and decide whether to accept it without opening an account or asking an issuer for permission.
Holding a note to the light does not provide a public audit of the aggregate money supply. But it does provide something ordinary users understand: local evidence that this object is probably authentic.
The digital ideal would combine three stronger properties:
Payment privacy by construction.
Monetary integrity that can be independently verified without trusting one operator’s private database.
Custody ordinary people can use without a seed-phrase ceremony or a bank’s permission.
The 1990s purses made custody intuitive and payments local. They gestured at privacy, but their monetary integrity ultimately rested on tamper-resistant hardware.
Bitcoin made monetary rules independently verifiable and turned payment history into public infrastructure.
Shielded ledgers can preserve monetary rules while concealing individual transactions. They may have two of the three. Humane custody remains unresolved.
What does key-holding hardware for shielded money look like when it has to work for someone’s grandmother?
Can a cheap secure element understand what it is signing rather than merely signing an opaque request?
Can a person lose the card without losing the money, while avoiding a portable recovery secret that recreates every failure mode of seed phrases?
And can two devices settle face-to-face, fully offline, without rebuilding Mondex inside the secure element?
The last question is the trap.
When neither participant can consult the ledger, the recipient has no global view with which to determine whether the same value has already been offered to somebody else. Something local must prevent the double-spend.
That something can be trusted hardware. It can be a small offline allowance. It can be an expiring balance, delayed settlement, eventual reconciliation, liability assigned to an intermediary, or some combination of them.
But it cannot be nothing.
The digital euro pilot demonstrates the trade-off directly. Its offline value is stored and processed inside a secure element. Value received offline may be spent again offline before reconnecting, while the secure-element software is expected to protect balances and prevent double-spending. The devices must later interact with the wider system for funding, defunding and clearance. European Central Bank
The card can stop being the monetary ledger.
For fully offline finality, it cannot always be only a passive key.
It may need to become a tightly constrained state machine: holding a limited offline allowance, enforcing local rules and eventually reconciling with a ledger that defines the actual currency. The engineering objective is not to pretend the hardware can never fail. It is to bound the amount that can fail with it, expire the risk and make any discrepancy visible when the device returns online.
That is the synthesis the 1990s did not have.
No general-purpose mass-market system has yet combined strong payment privacy, independently verifiable monetary integrity and custody simple enough for ordinary people — while also preserving useful offline payment.
Whoever ships it will have built what Swindon was promised in July 1995, minus the assumption that made the original design dangerous.
The card can be the wallet.
It can be the key.
For a few offline payments, it may even carry a tightly bounded piece of state.
It must never again be the monetary system.