Restructuring the Offline Retail CBDC Privacy and Security Architecture: Moving Beyond Balance-Based Vulnerabilities

Offline retail central bank digital currencies (CBDCs), including the planned offline digital euro, rely on a tamper-resistant secure element (SE) in the holder’s device to hold value and prevent double spending. This white paper asks what an issuer can still do when that component fails at scale. Where the validity of offline value rests solely on the integrity of the SE, a batch-wide or low-cost key-recovery flaw in certified hardware, for which there are precedents across vendors, becomes a source of unbacked central bank liabilities that the issuer can neither bound nor attribute. The paper gives an explicit loss model and derives the aggregate detection threshold: unbacked value becomes visible only once the amount already redeemed exceeds the legitimate value held on devices that have not reported, so the privacy of offline holdings and the size of the undetectable fraud budget move together. After detection, every available response, from hardware re-issuance and key rotation to throttling or suspending the offline rail, either leaves the loss open or delivers the disruption a hostile adversary seeks: a self-defense trap. Per-person holding limits do not help, because the same component enforces them. Building on a framework of design axes and privacy properties, the paper adds four containment properties (bounded loss, attribution, quarantine granularity, and detection and revocation latency), assesses five designs against them, and prices an object-centric alternative proposed by the authors, authenticated lineage tokens, in which offline value carries evidence that can be checked independently of the SE, including its data-protection implications. It closes with recommendations on limits, detection, procurement, incident response, loss allocation and identity recovery, set against the state of the digital euro legislation as of October 2026. The analysis is architectural: it tests no product and claims no vulnerability in any deployed or planned device.