Short answer: Quantum money is a cryptographic idea, not a currency: banknotes would be quantum states, and the no-cloning theorem is what makes them hard to copy. Wiesner proposed the first scheme, a private-key one that only the issuing bank can verify, in 1969 (published in 1983). A 2012 paper proposed the first public-key scheme that anyone can verify and that is cryptographically secure under a classical hardness assumption. This is theory, and nobody has issued such money.
The idea
Lecture notes from an MIT quantum cryptography course say arbitrary quantum states cannot be copied, as the no-cloning theorem decrees. While this is an annoyance when building quantum memory, it enables a cryptographic task: a monetary system whose security relies on quantum mechanics. Banknotes would be quantum states, and uncopyability would follow from quantitative versions of the no-cloning theorem.
Wiesner's private-key scheme
A Communications of the ACM article says Stephen Wiesner described private-key quantum money in the first quantum cryptography paper ever written, in 1969, though it was not published until 1983. In his scheme each quantum bill is a unique random quantum state labelled with a serial number, and the mint keeps track of the state for each serial number and uses that knowledge to verify the money.
The lecture notes give the construction: to make a banknote with a serial number, the bank picks random pairs of bits and creates qubits that are each independently one of the states |0>, |1>, |+> or |->. The bank stores the pairs as a private verification key. To verify, the bank looks up the key and applies a projective measurement that checks the note lies in the valid subspace. The notes also describe permissive, strict and super-strict testing, which differ in what the bank does with the state after the check.
Public-key quantum money
The CACM article says that in public-key quantum money anyone should be able to verify the money without communicating with the mint, and that this would be the ideal money if it could be realized. It says Aaronson proposed the first concrete public-key scheme, which a later paper showed to be insecure, and that a later paper introduced collision-free quantum money, where nobody, even the mint, can produce two bills with the same serial number.
A 2012 paper on the IACR ePrint archive says it proposes the first quantum money scheme that is public-key and cryptographically secure under a classical hardness assumption unrelated to quantum money. It is based on hidden subspaces, encoded as the zero-sets of random multivariate polynomials. It says the black-box version, with classical oracles in place of the polynomials, is unconditionally secure. It also says it patches a major security hole in Wiesner's scheme, giving a private-key scheme that allows unlimited verifications and stays unconditionally secure even if the counterfeiter interacts adaptively with the bank. The verifier needs only two tests, one in the standard basis and one in the Hadamard basis.
What this does not tell you
These sources describe theoretical schemes. They do not describe a working implementation, and keeping quantum states intact long enough to circulate as money is an unsolved engineering matter these sources do not address. Nothing here relates to digital currencies or any financial product.
FAQ
What is quantum money?
A proposed form of unforgeable money whose notes are quantum states, protected by the no-cloning theorem.
Who proposed it?
Stephen Wiesner, in a paper written in 1969 and published in 1983, per the CACM article.
What is public-key quantum money?
Money that anyone can verify without contacting the mint. A 2012 paper proposed a secure scheme under a classical hardness assumption.
Does it exist in practice?
These sources describe theory only.
Is it related to cryptocurrency?
No. It is a cryptographic concept about unclonable states.
All field notes