A digital banknote
Value is carried in discrete notes, spent in slots, verified locally. The note is a bearer object; the protocol is what makes the bearer honest.
Protocol
A digital banknote, and the rules that keep its bearer honest.
Pactena is a payment protocol. It is not a currency and it is not a market. It defines how a digital banknote is issued, spent, transferred and redeemed — with the privacy of cash, and an accountability property cash has never had.
What it is
Two layers
An account layer handles threshold key management: the account key is generated distributed and never exists as a whole, not even at signing time. A payment layer handles issuance, spending and transfer.
One trust chain
Root → Issuer → Merchant/User. Every edge is a certificate under the same scheme; every check is the same verification function.
What it is not
Not a generic zero-knowledge circuit
Five targeted primitives and one lightweight construction, chosen for this problem. No proving system to trust, no circuit to audit, no trusted setup ceremony to explain.
Not a sigma protocol, a range proof, or an accumulator
The verification is a small, fixed set of targeted checks. It does not grow with the statement.
Not dependent on secure hardware
No security hardware, no vendor gatekeeper. The client runs on an ordinary phone. This is the difference from every central-bank offline pilot published so far.
Not a new currency
It carries whatever money the issuer puts behind it.
The offline double-spend result
Offline double-spend has been an open problem of digital cash for decades. It is the reason central-bank offline experiments still rely on special-purpose secure hardware.
Pactena is the first known implemented solution that answers it purely at the protocol level, with no hardware trust: anyone who spends the same digital banknote twice makes their own secret key computable — the fraud identifies the cheat, personally. Five things you can check: a reference implementation, measured offline verification of about 12 ms, a stated curve choice, a working demonstrator, and published byte sizes.
As of August 2026 no other publicly documented, working system is known that guarantees this through an offline chain of transfers as well: a double-spend names exactly the original cheat, and every other honest member of the chain keeps their anonymity — neither the honest holders before the cheat nor those after them are exposed, or even made suspect. By the construction's theorem, an honest holder cannot be framed. External cryptographic review of the payment layer is under way; the outcome will be published.
Fraud reveals itself.
If you want to argue with that
Identity-revealing detection in the Chaum line stayed theoretical; it never ran in a live system, at real scale. Published central-bank offline pilots build on security hardware — exactly the hardware trust Pactena removes. And no published, working system is known that combines multi-hop offline attribution with non-frameability. If you know of one, we would genuinely like to read about it.