Selling the Unspent Chain
Combining Payment Channels, E-Cash, and Partial Hash Chains So a Million Micropayments Can Be Sold Before They Are Spent
Keywords: Bitcoin; hash chains; payment channels; electronic cash; e-cash tokens; partial transfer; micropayments; PayWord; blind payments; denomination; settlement; nChain; unspent chain; secure resale.
Consider a concrete commercial problem. A provider has a hash chain of one million links: a single committed value at the tip, and a million pre-images behind it, each redeemable as one unit of payment. The provider has spent none of them. The question is not whether the provider can spend them one at a time — that is the ordinary hash-chain micropayment, settled and understood. The question is whether the provider can sell the unspent remainder, in whole or in part, as a secure instrument: hand over the unused links — or a defined block of them — to a buyer who can then redeem or resell them, with the same security the original holder enjoyed, and without trusting an intermediary not to double-spend the same links elsewhere.
This is a real requirement and it is harder than it looks, because a hash chain is not natively a bearer instrument. The pre-images are just numbers; whoever holds a copy can present it. If the provider keeps a copy after selling, the provider can race the buyer to redemption. A naive sale of an incomplete group of hash links is insecure precisely because nothing on the chain prevents the seller from spending what they sold. To make the partial chain securely transferable, three things must be combined: the hash chain that amortises the signature over many payments, the payment channel that settles the chain against the ledger, and the electronic-cash construction that makes each unit a denominated, bearer token whose control transfers cleanly and whose double-spend is prevented by the ledger rather than by trust.
The combination is exactly what a family of nChain patents, read together, supplies. The hash-chain micropayment channel settles a sequence of cheap transfers against the fixed Bitcoin ledger. The off-chain transfer patent (nChain, 2024c) lets the control of a funded position pass from one party to another by key replacement, so the seller’s claim is extinguished as the buyer’s is created. The tokenisation patent (Wright & Savanah, 2022) makes each unit a denominated token pegged to a fixed quantity of Bitcoin, divisible and transferable. And the finite-token construction (Wright & Savanah, 2025) shows how a published, finite set of one-satoshi-backed tokens functions as anonymous bearer units within the set. This essay assembles these into the answer to the provider’s problem, and states the principle once: a hash chain becomes securely sellable when each unspent link is an e-cash token whose transfer extinguishes the seller’s claim and whose uniqueness is enforced by the ledger.
I. The Hash Chain as a Stack of Coins
The hash chain is the oldest piece. Lamport (1981) described repeated authentication from a single committed value: apply a one-way function many times to a secret seed, publish the final value, and reveal pre-images in reverse order, each verifiable against the last because the function cannot be inverted. Rivest and Shamir (1997) turned this into payment in their PayWord scheme: the user signs the tip of the chain once, and each pre-image becomes a redeemable coin, spent by release and redeemed in aggregate. One signature underwrites the whole chain; the per-coin cost is a single hash evaluation. This is why hash chains are the natural substrate for micropayments — the expensive public-key operation is amortised across the entire sequence (Rivest & Shamir, 1997).
A chain of one million links is therefore a stack of one million coins sharing one signed commitment. The crucial property for resale is that the coins are ordered and partial-revealable: revealing the pre-image at position k implicitly certifies every coin up to k, because each is derivable from the next by hashing. A holder who has spent up to position 300,000 has 700,000 unspent links remaining. Those 700,000 are a contiguous, well-defined block of value: the coins from position 300,001 to 1,000,000. The provider’s problem is to sell that block — or any sub-block of it — securely.
The obstacle is that the pre-images are copyable. If the provider simply sends the buyer the seed material for links 300,001 onward, the provider still knows that material and can spend those links first. The hash chain alone gives cheap sequential payment but not secure transfer of the unspent remainder, because it has no mechanism to extinguish the seller’s ability to spend what was sold. That mechanism must come from the payment channel and the e-cash construction layered on top.
II. The Payment Channel That Settles the Chain
The payment channel supplies settlement and the enforcement of the latest state. In the original Bitcoin protocol, a channel is built from the transaction-replacement mechanism: a funding transaction locks a quantity of satoshis, and the parties exchange successively-updated versions of a spending transaction, the latest version superseding earlier ones, with only the final state recorded on chain. Decker and Wattenhofer (2015) gave a rigorous duplex construction in which an invalidation tree of decrementing time-locks guarantees that a newer channel state can always be confirmed ahead of any older state it replaces, so the most recent agreed allocation is the one that settles.
A hash-chain micropayment channel marries the two. The channel is funded once on chain. Within it, the payer advances along the hash chain, each released pre-image authorising an incremental reallocation of the funded amount toward the payee. The channel guarantees that the payee can, at any time, close the channel on chain at the current position, claiming the value of the links revealed so far; and it guarantees the payer cannot reclaim value already paid, because the latest state supersedes the earlier ones. The hash chain provides the cheap per-payment step; the channel provides the on-chain enforcement of where the chain currently stands. The BitcoinSV protocol description of streaming payment channels makes the structure explicit: content or service is delivered frame by frame, each frame hashed, with the payer signing successive channel revisions using signature-hash flags that commit to the payer’s input while leaving the settlement output composable, so the provider can close at the latest revision (nChain streaming-channel construction).
This gives the provider a settled position: at any moment, the channel encodes how much of the chain has been spent and how much remains. The unspent remainder is not just an abstract block of pre-images; it is a quantified, channel-enforced claim on the funded satoshis. That is the thing to be sold. But the channel alone still does not let the provider hand that claim to a buyer, because the channel is a two-party construction between the original payer and payee. Transferring the remainder to a third party requires the e-cash layer.
III. The E-Cash Layer: Making Each Link a Bearer Token
The electronic-cash construction is what converts the unspent remainder from a private two-party claim into a transferable bearer instrument. Two nChain patents supply the mechanism, and they approach it from complementary directions.
The tokenisation patent (Wright & Savanah, 2022) makes a quantity of Bitcoin into a token by embedding metadata in a pay-to-script-hash redeem script, at a position the protocol treats as a public-key slot, so that the satoshis are locked on chain in association with the token and can be redeemed only by presenting a redeem script that hashes to the committed value. Critically for resale, the patent claims that the token can be divided, producing two or more outputs each relating to a tokenised quantity, and that tokens can be transferred between users with the issuer co-signing the redeem script to authorise the transfer (Wright & Savanah, 2022). A token of value can be split into a spent portion and an unspent portion, and the unspent portion re-issued to a new holder. Mapped onto the hash chain: the unspent remainder of the chain is a token of a definite value, and the tokenisation construction lets it be split at the current chain position and the remainder re-issued to the buyer.
The finite-token construction (Wright & Savanah, 2025) supplies the bearer property. It describes creating a finite set of tokens on Bitcoin, each token being a public-key/private-key pair with a small quantity of Bitcoin — one satoshi in the worked example — loaded into its address to make it a valid spendable output. The set of token addresses is published before use; the mapping from holder to specific token is not published, so within the finite set the tokens are anonymous bearer units, and control of a token is control of its private key (Wright & Savanah, 2025). This is the e-cash coin in its barest form: a denominated, spendable, anonymous-within-the-set unit whose double-spend is prevented by the ledger, because each token’s satoshi can be spent once. A hash chain’s links, mapped to such tokens, become a stack of bearer coins rather than a stack of copyable numbers.
The combination resolves the copyability obstacle of Section I. If each unspent link is bound to a token whose control is a private key, then transferring the link means transferring control of that key — and the off-chain transfer construction makes that transfer extinguish the seller’s claim, as the next section shows. The seller cannot race the buyer, because after transfer the seller no longer controls the token; the ledger will honour only the holder of the current key.
IV. The Transfer That Extinguishes the Seller’s Claim
The decisive mechanism for secure resale is the off-chain transfer patent (nChain, 2024c), Secure off-chain blockchain transactions. Its method attaches a digital asset to an exchange platform by computing a shared key from a key of the first party and a key of the platform, and depositing the asset on chain under that shared key. To transfer the asset to a second party, the platform computes a second key from a key of the second party such that the first party’s key becomes invalid and a second shared key, computed from the second party’s key and the platform’s new key, governs the asset; the second party can then detach the asset using the second shared key (nChain, 2024c).
The property that matters for selling the unspent chain is the one the claim states directly: on transfer, the first party’s key becomes invalid. The seller’s ability to control the asset is extinguished at the moment the buyer’s control is created. This is precisely what a secure sale of copyable pre-images requires and what the bare hash chain lacks. When the unspent remainder is held as an asset under this construction, selling it to a buyer replaces the key that controlled it; the seller’s former key no longer unlocks anything; the buyer’s new shared key does. The race condition is closed not by trusting the seller to delete their copy but by making the seller’s copy worthless.
The patent adds two features that make the transfer robust for commercial resale. First, the construction generates multiple transactions valid in different circumstances, so that a settling transaction can be recorded depending on how the counterparties behave, and at least some of the generated transactions remain valid for on-chain recording even if the exchange platform fails entirely; the full private key, and thus ownership, can be proven at any time (nChain, 2024c). The buyer is not left exposed to platform failure: the unspent remainder can always be settled on chain. Second, the transfer is instant and off-chain, so a sale of the remainder does not itself require an on-chain transaction — the chain of one million links can change hands without a million ledger writes, or even one, until settlement is desired.
Combining this with the tokenisation split of Section III gives the full operation. The provider, having spent up to position 300,000, splits the token at the current position: the spent portion settles or lapses, and the unspent portion — links 300,001 to 1,000,000 — is re-issued as a fresh token. That token is transferred to the buyer by the key-replacement method, extinguishing the provider’s control. The buyer now holds the unspent remainder as a bearer token, can advance along the remaining links through the payment channel exactly as the provider could, and can in turn split and resell any further sub-block to a third party by the same method. The incomplete group of hash links has been sold securely.
V. Selling an Incomplete Group
The provider’s requirement was specifically to sell an incomplete group — not the whole chain, but a defined block of unspent links — and to do so securely. The construction supports this at arbitrary granularity, and it is worth tracing why, because the partial-transfer case is where the combination of the three layers earns its keep.
The hash chain’s ordering makes any contiguous block well-defined: links a through b are a sub-stack of coins, certified by the pre-image at position b and bounded below by position a. The tokenisation split makes that sub-stack a token of definite value, because the patent’s division claim produces outputs each relating to a tokenised quantity, and the value of the block is the number of links times the per-link denomination (Wright & Savanah, 2022). The off-chain transfer moves control of that token to the buyer and invalidates the seller’s key (nChain, 2024c). And the payment channel lets the buyer redeem the block incrementally against the funded satoshis, closing on chain at whatever position the buyer reaches (Decker & Wattenhofer, 2015). A provider can thus sell links 300,001 to 500,000 to one buyer and 500,001 to 1,000,000 to another, each as a separate token, each transferred securely, each redeemable independently. The million-link chain becomes a divisible inventory of bearer coins.
The security of the incomplete-group sale rests on a property worth stating plainly: the buyer of a sub-block must be unable to spend links outside their block, and the seller must be unable to spend links inside it. The first is handled by the chain’s structure and the token’s value bound — the buyer’s token certifies only the block they bought, and presenting a pre-image outside it does not unlock value they do not hold. The second is handled by the key-replacement transfer — once the block is sold, the seller’s key over it is invalid. Neither party can encroach on the other’s links, and the ledger enforces single-spend over the whole. The incomplete group is as secure in the buyer’s hands as the complete chain was in the seller’s.
This is the commercial unlock. A provider who has minted a large hash chain need not spend it down themselves to realise its value; they can wholesale the unspent inventory in blocks, and each buyer can retail it further. The chain becomes a tradeable instrument whose liquidity does not depend on its being fully consumed by the original holder. A million micropayments can be sold before any of them is spent, and the incomplete remainder can change hands repeatedly, each transfer secure and each settlement deferred until a holder chooses to close against the ledger.
VI. A Worked Example: One Million Links
Make the construction concrete with the provider’s own figures, and label the arithmetic for what it is: an illustration of the mechanics, not a measurement of any deployed system. Suppose the chain has one million links and each link is denominated at one unit — for definiteness, take the unit as a single satoshi, so the chain represents one million satoshis of value committed behind the funding transaction. The provider has spent links one through three hundred thousand in the ordinary course, advancing the payment channel to position 300,000. Seven hundred thousand links remain unspent: positions 300,001 through 1,000,000, a block worth 700,000 satoshis at the stated denomination.
The provider wishes to sell this remainder in two blocks: positions 300,001 to 650,000 to one buyer, and 650,001 to 1,000,000 to another. Each block is a contiguous, well-defined sub-stack of the chain, certified at its upper bound by the corresponding pre-image and bounded below at its lower position. The tokenisation split (Wright & Savanah, 2022) makes each block a token of definite value: the first block is a token of 350,000 units, the second a token of 350,000 units, and the two sum to the 700,000-unit remainder. The arithmetic is exact and the ledger will enforce it: 300,000 spent plus 350,000 plus 350,000 equals the original one million, and no satoshi is created or destroyed in the splitting.
For each block, the off-chain transfer (nChain, 2024c) replaces the controlling key, so that on completing the sale of the first block the provider’s key over positions 300,001 to 650,000 becomes invalid and the first buyer’s key governs them; and likewise for the second block and the second buyer. After the two sales the provider controls nothing in the range 300,001 to 1,000,000; the first buyer controls 300,001 to 650,000; the second controls 650,001 to 1,000,000. None can encroach on another’s block, because the chain’s structure binds each pre-image to its position and the key replacement extinguishes prior control. The provider has realised 700,000 units of value without spending a single further link themselves, and without writing anything to the ledger, because the transfers are off-chain.
Each buyer now holds a smaller unspent chain and can do with it exactly what the provider could: spend it link by link through a payment channel, or split it again and resell a sub-block to a third party. The first buyer might spend 100,000 links and resell the remaining 250,000; the chain of ownership can extend indefinitely, each transfer secure by the same key-replacement property, each settlement deferred. Across the entire life of the chain — one million micropayments, plus an arbitrary number of intervening sales and resales — the ledger records two events that touch the base: the funding transaction that opened the channel, and the final settlement that closes it. Everything between is off-chain construction. The one million satoshis behind the funding transaction are conserved exactly throughout; what moves, repeatedly and freely, is control of the unspent links.
The numbers also make the amortisation visible. The single signature on the chain’s commitment (Rivest & Shamir, 1997) underwrites all one million links; the per-link cost in the spending direction is one hash evaluation. The sales add the cost of a token split and a key replacement per block sold, which is incurred once per sale rather than per link — selling a block of 350,000 links costs one split and one transfer, not 350,000 of them. The overhead is therefore dominated by the number of sales and settlements, not by the number of links or payments, which is precisely the property that makes the instrument economical at the scale of a million units. A provider does not pay a million times to sell a million links; they pay once per block transferred and twice for the channel.
VII. Why the Three Must Be Combined
It is worth being explicit about why no single layer suffices, because the value of the construction is in the combination and the failure modes of the parts illuminate it.
The hash chain alone gives cheap, ordered micropayments but no secure transfer: the pre-images are copyable, so a sale cannot extinguish the seller’s ability to spend. A provider holding a hash chain can spend it but cannot safely sell the remainder, because nothing stops them from spending what they sold. The chain is a private instrument, not a bearer one.
The payment channel alone gives settlement and latest-state enforcement but is intrinsically two-party. A channel is between a specific payer and payee; it has no native notion of handing the payee’s position to a third party. A channel can settle a hash chain but cannot, by itself, make the unspent remainder sellable to someone outside the channel. It supplies enforcement, not transferability.
The e-cash token alone gives bearer transfer and denomination but, without the chain, loses the amortisation that makes micropayments cheap, and without the channel, must settle each transfer on chain or trust an issuer. A token is transferable but, standing alone, is either expensive to move at micropayment scale or dependent on a trusted mint to net transfers off chain.
Combined, each supplies what the others lack. The hash chain makes the payments cheap and ordered. The channel settles them against the ledger and enforces the latest position. The e-cash token makes each unit a bearer instrument, and the off-chain key-replacement transfer makes the sale of the remainder secure by extinguishing the seller’s claim. The result is a single instrument — an unspent hash chain held as divisible e-cash tokens, settled through a channel — that is cheap to spend, secure to sell in whole or in part, and trustless because the ledger, not an intermediary, prevents double-spend. The whole is the thing the provider needed and no part could deliver.
The contrast with the historical alternative sharpens the point. Chaum’s e-cash (Chaum, 1983) could make a token unlinkable and transferable, but it required a mint trusted not to over-issue and obliged to be online to catch double-spends; selling an unspent stock of Chaumian tokens meant trusting that mint at every step. The construction here removes that mint. Over-issue is impossible because the tokens are backed by satoshis on a fixed-supply ledger; double-spend is caught by the network rather than by a mint’s online database; and the secure transfer of the unspent remainder is achieved by key replacement (nChain, 2024c) rather than by a mint re-issuing tokens to a new holder. The trust that Chaum’s scheme placed in a single issuer is replaced by the consensus enforcement of the base layer and a transfer mechanism that cannot be gamed by the seller. What remains is reduced to a platform trusted only for liveness and correct protocol execution, and even that platform cannot steal the asset nor strand the buyer if it fails. The provider sells the unspent chain without asking any buyer to trust a mint.
VIII. The Fixed Base Beneath the Tradeable Chain
All of this rests on the fixed Bitcoin base, and the dependence is not incidental. The reason the e-cash tokens need no trusted mint is that the ledger enforces, for every token, that its backing satoshi is spent once and that no satoshi exists outside the fixed issuance. The reason the channel’s latest state is final is that the consensus rules honour the superseding transaction. The reason the buyer of an incomplete group can trust their block is that the ledger will settle it regardless of the platform’s fate. Every security property of the combined instrument traces back to the immutability and single-spend enforcement of the base layer.
The economic shape is the now-familiar separation of stock and flow. The satoshis funding the channel are a fixed quantity; they are neither created nor destroyed as the hash chain is spent, sold, resold, and finally settled. What moves is the control of the unspent remainder, and that can move an arbitrary number of times — sold in blocks, resold by buyers, advanced link by link — while the base quantity sits unchanged behind the channel until a holder closes it. A million links can mediate a million micropayments and any number of intervening sales, and the ledger records two events: the channel opens, and the channel closes. The flow of payments and the flow of ownership are both unbounded by the fixed base; only the final settlement touches it.
This is why the construction is built on the original protocol rather than a modified chain. The transferability and the cheapness live entirely in the construction — the hash chain, the channel updates, the token splits, the key replacements — none of which require any change to the consensus rules. Nodes validating under the original rules see a funding transaction and, eventually, a settling transaction; the million payments and the chain of sales between them are off-chain constructions visible only to the parties. The fixed base supplies the trust; the construction supplies the function; and the two together give the provider a hash chain they can sell before they spend.
IX. What the Patents Claim and What They Do Not
A caveat is owed, stated plainly. The claim of this essay is that these patented constructions, combined, solve the stated problem; it is not that any single patent claims the entire combination as one method. I have read the operative claims of the off-chain transfer patent (nChain, 2024c), the tokenisation patent and its division and transfer claims (Wright & Savanah, 2022), and the finite-token construction (Wright & Savanah, 2025), together with the original-protocol channel mechanism and the peer-reviewed hash-chain and channel literature (Decker & Wattenhofer, 2015; Lamport, 1981; Rivest & Shamir, 1997). The combination into a single instrument for selling partial hash chains is the architecture this essay describes; the patents supply the components and, in the case of the off-chain transfer, the specific key-invalidation property that makes the resale secure.
Two limits should be acknowledged. First, the off-chain transfer construction relies on an exchange platform trusted to follow the protocol, even though it is constructed so that the platform cannot steal the asset and so that settlement survives the platform’s failure (nChain, 2024c). That is a reduced trust assumption, not zero trust; the platform is trusted for liveness and correct protocol execution, not for custody. Second, the anonymity of the finite-token construction is anonymity within the published set (Wright & Savanah, 2025); it is statistical and set-dependent, as all such anonymity is, and a small set hides little. Neither limit defeats the construction, but an honest account names them rather than implying an unconditional result.
What survives scrutiny is the core claim. A hash chain’s unspent remainder can be made into a secure, divisible, bearer instrument by binding each link to an e-cash token, settling the chain through a payment channel, and transferring the remainder by a key-replacement method that extinguishes the seller’s control. The double-spend that would make a naive sale of copyable pre-images insecure is prevented by the fixed ledger; the trust that Chaum’s mint required is reduced to a platform that cannot steal and whose failure does not strand the buyer. A million micropayments, sold before they are spent, in whole or in incomplete part — this is what the combination delivers.
X. Synthesis
The provider’s problem was to sell an unspent hash chain — a million links, or any block of them — securely, so that the seller cannot race the buyer and the buyer inherits the same security the seller held. The bare hash chain cannot do this, because pre-images are copyable. The combination can.
The hash chain (Lamport, 1981; Rivest & Shamir, 1997) makes a million payments share one signed commitment, cheap to spend in sequence. The payment channel (Decker & Wattenhofer, 2015; original-protocol replacement) settles the chain against the fixed ledger and enforces the latest position. The tokenisation construction (Wright & Savanah, 2022) makes each unit a denominated token, divisible into spent and unspent portions and transferable between holders. The finite-token construction (Wright & Savanah, 2025) makes each unit an anonymous bearer coin whose double-spend the ledger prevents. And the off-chain transfer construction (nChain, 2024c) moves the unspent remainder to a buyer by replacing the controlling key, extinguishing the seller’s claim at the instant the buyer’s is created — the property that makes the partial sale secure.
Combined, these give a single tradeable instrument: an unspent hash chain, held as divisible e-cash tokens, settled through a channel on the fixed Bitcoin base. It is cheap to spend, secure to sell in whole or in incomplete part, resellable down a chain of buyers, and trustless in its double-spend protection because the immutable ledger supplies it. The fixed base is touched twice — channel open, channel close — while an unbounded flow of payments and ownership transfers occurs between. A million micropayments can be sold before any is spent, and the incomplete remainder can change hands as freely as cash, because each link has been made into cash and the ledger keeps the count honest.
The hash chain is the inventory; the channel is the till; the e-cash token is the coin; the key-replacement transfer is the act of handing the coin over so the giver no longer holds it. Put them together on a fixed ledger and you can sell the unspent chain. The principle, having been stated and defended, is done.
References
Chaum, D. (1983). Blind signatures for untraceable payments. In D. Chaum, R. L. Rivest, & A. T. Sherman (Eds.), Advances in cryptology: Proceedings of Crypto ’82 (pp. 199–203). Plenum Press. https://doi.org/10.1007/978-1-4757-0602-4_18
Decker, C., & Wattenhofer, R. (2015). A fast and scalable payment network with Bitcoin duplex micropayment channels. In A. Pelc & A. A. Schwarzmann (Eds.), Stabilization, safety, and security of distributed systems (SSS 2015) (Lecture Notes in Computer Science, Vol. 9212, pp. 3–18). Springer. https://doi.org/10.1007/978-3-319-21741-3_1
Lamport, L. (1981). Password authentication with insecure communication. Communications of the ACM, 24(11), 770–772. https://doi.org/10.1145/358790.358797
nChain Licensing AG. (2024c). Secure off-chain blockchain transactions (U.S. Patent No. US 12,056,694 B2). U.S. Patent and Trademark Office.
Rivest, R. L., & Shamir, A. (1997). PayWord and MicroMint: Two simple micropayment schemes. In M. Lomas (Ed.), Security protocols (Security Protocols Workshop 1996) (Lecture Notes in Computer Science, Vol. 1189, pp. 69–87). Springer. https://doi.org/10.1007/3-540-62494-5_6
Wright, C. S., & Savanah, S. (2022). Universal tokenisation system for blockchain-based cryptocurrencies (U.S. Patent No. US 12,406,237 B2). U.S. Patent and Trademark Office.
Wright, C. S., & Savanah, S. (2025). Blockchain implemented counting system and method for use in secure voting and distribution (U.S. Patent No. US 12,271,466 B2). U.S. Patent and Trademark Office.