Non-custodial peer-to-peer Bitcoin exchanges occupy an awkward position in the cryptocurrency landscape. They promise something that sounds almost contradictory: the ability to trade bitcoin for fiat currency without handing control of your coins to a third party. A centralized exchange is easy to understand — you deposit funds, you trust the operator, you trade. A non-custodial P2P exchange asks you to trust mathematics, protocol design, and economic incentives instead of a company. The result is a set of architectures that are technically elegant but operationally messier than their custodial counterparts. This essay examines how these systems actually work, where they break down, and what the trade-offs mean for anyone who uses them.

The category matters because the custodial model has repeatedly failed users. The collapse of Mt. Gox, the freezing of withdrawals at FTX, and the more routine pattern of exchanges restricting access during periods of volatility have made the case that holding your own keys is not merely an ideological preference but a practical risk-management decision. Non-custodial P2P exchanges are an attempt to extend self-custody from holding into trading. The question is whether the technical mechanisms they employ are strong enough to support that extension without introducing new failure modes that are just as damaging.

The Escrow Problem

Every trade involves a sequencing problem. The buyer does not want to send fiat before receiving bitcoin, and the seller does not want to release bitcoin before receiving fiat. In a face-to-face cash trade, the two parties can settle simultaneously. Over the internet, with fiat rails that finalize in hours or days and bitcoin transactions that finalize in minutes, simultaneity is impossible. Someone has to go first. Escrow is the mechanism that makes going first safe enough to be tolerable.

Custodial exchanges solve the escrow problem by becoming the escrow. The exchange holds the bitcoin, the buyer sends fiat to the exchange or to the seller, and the exchange releases the bitcoin when its internal ledger says the fiat has arrived. This works, in the sense that trades settle, but it concentrates risk in the operator. Non-custodial P2P exchanges try to achieve the same settlement guarantee without giving any single party the ability to unilaterally move the funds. The technical tools available for this are limited: Bitcoin script, multisignature addresses, time locks, Lightning hold invoices, and the economic lever of security deposits. Every non-custodial P2P model is a different arrangement of those tools.

Model One: The 2-of-3 Multisig Escrow

The most intuitive non-custodial escrow design is a 2-of-3 multisignature address. Three keys exist. Any two can release the funds. In the canonical arrangement, the buyer holds one key, the seller holds another, and the platform or an independent arbitrator holds the third. In the normal case, the buyer and seller cooperate, sign the release transaction together, and the arbitrator's key never comes into play. If the parties disagree, the arbitrator signs with whichever party the dispute process determines is entitled to the funds.

Hodl Hodl is the clearest implementation of this model. Every trade generates a unique P2SH multisignature address. The seller deposits bitcoin into the address. The buyer sends fiat directly to the seller through whatever payment method the two parties agreed on. When the seller confirms receipt of the fiat, the seller and buyer co-sign the release, and the bitcoin goes to the buyer's wallet. Hodl Hodl never holds the funds at any point. The platform holds one key, but that key alone cannot move the bitcoin. Even if Hodl Hodl were compromised, the funds in escrow would remain inaccessible to an attacker who did not also control one of the other two keys.

The dispute path is equally straightforward in principle. If the buyer claims to have paid and the seller denies receiving payment, either party can open a dispute. A Hodl Hodl administrator reviews the evidence and then uses the platform's key in combination with either the buyer's key or the seller's key to release the funds to the party the administrator deems entitled. The administrator cannot release the funds unilaterally. The requirement of a second signature is what keeps the model non-custodial even during dispute resolution. The platform has influence, but it does not have control.

This design has real advantages. It uses only standard Bitcoin script, so there is no dependency on exotic smart-contract platforms or Layer 2 liquidity. The escrow address is visible on-chain, so both parties can verify that the bitcoin is actually locked. The recovery procedure is published, meaning that even if Hodl Hodl's website goes offline, the parties can construct and broadcast the release transaction themselves. The model has operated since 2016 without a platform-level loss of funds, which is a meaningful track record in an industry where operational failures are common.

The weaknesses are equally clear. A 2-of-3 escrow with a platform-held key introduces a coordination dependency: if the platform disappears permanently and the two trading parties cannot cooperate, the funds can remain locked indefinitely. There is no built-in time lock that automatically returns the bitcoin to the seller after a certain period. Someone has to act. The model also offers limited protection against a determined liar. If the buyer pays fiat from an account that is not in their own name, or if the buyer later reverses the payment through a chargeback mechanism, the seller may release the bitcoin in good faith only to discover that the fiat has been clawed back. The escrow protects against unilateral bitcoin seizure, but it does not protect against fiat fraud.

Model Two: 2-of-2 Multisig with Security Deposits and Tiered Dispute Resolution

Bisq takes a different approach. The current trade protocol, introduced in version 1.2 and refined by the Burning Men protocol for trades placed after January 1, 2023, uses a 2-of-2 multisignature escrow rather than a 2-of-3 arrangement. Only the buyer and the seller hold keys. There is no third key held by an arbitrator or a platform. On the face of it, this seems to make dispute resolution impossible: if the two parties cannot agree, neither can move the funds. The resolution lies in a combination of economic incentives and pre-signed transactions that route the dispute away from the escrow itself.

The first incentive is the security deposit. Both traders lock bitcoin into the multisignature address alongside the trade amount. The buyer's deposit is typically between 15% and 50% of the trade amount, with an absolute minimum of 0.001 BTC, and the seller's deposit is set by the offer maker and matched by the taker. These deposits are not a fee. They are returned in full when the trade completes without a dispute. They function as a bond: a trader who violates the protocol or attempts to stall the process puts their own capital at risk. The deposit is the most important tool Bisq has for encouraging cooperative behavior, because it makes misbehavior costly in a way that a purely reputational system does not.

The second mechanism is the time-locked payout transaction. At the beginning of a trade, both parties sign a transaction that would send all the funds in the multisig escrow — the trade amount and both security deposits — to a Bisq donation address. This transaction is not broadcast immediately. It becomes publishable after a delay: ten days for altcoin trades and twenty days for fiat trades. The existence of this transaction means that the escrow is never permanently locked. If the parties cannot resolve their disagreement, either can publish the time-locked transaction, which moves the funds out of the 2-of-2 escrow and into a dispute-resolution process. The threat of the time-locked transaction also limits the ability of a malicious party to hold the other side's funds hostage indefinitely.

Dispute resolution itself proceeds in three tiers. The first tier is direct chat between the traders, conducted over Bisq's end-to-end encrypted messaging system. Many disputes are simply misunderstandings or communication failures, and the first tier handles those without any third-party involvement. The second tier is mediation. A mediator — a bonded contributor with a stake in the Bisq DAO — examines the evidence and suggests a payout split. If both traders accept the suggestion, the payout is executed and the trade closes. Mediation is not binding. It is a structured negotiation assisted by someone with experience in these disputes.

The third tier is arbitration, and it is designed to be rare. If one or both traders reject the mediator's suggestion, they can request arbitration after publishing the time-locked transaction. The funds have already left the 2-of-2 escrow and gone to the donation address. The arbitrator then re-examines the case. If the arbitrator determines that the trader requesting arbitration deserves a payout, the arbitrator reimburses that trader personally and requests reimbursement from the Bisq DAO. The arbitrator is not moving escrowed funds, because the escrowed funds are gone. The arbitrator is making a judgment about who should be compensated and then using the DAO's resources to execute that judgment. This structure removes the arbitrator's ability to unilaterally seize user funds, which was the main criticism of the older 2-of-3 model, but it also makes arbitration a slower and more bureaucratic process than mediation or direct negotiation.

The Burning Men protocol changed the compensation rules for arbitration. Under the older system, the winning party in arbitration could receive the losing party's security deposit. Under the current protocol, the winning party receives the trade amount and their own deposit, and may receive only a limited portion of the losing party's deposit, depending on the deposit percentage. The losing party may lose only part of their deposit rather than the full amount. The change was made to reduce the incentive for malicious actors to exploit the arbitration process itself, particularly the risk that a compromised or colluding arbitrator could profit by steering cases toward predetermined outcomes. The trade-off is that arbitration is now less punitive for the losing party, which slightly weakens the deterrent effect of the deposit for behavior that escalates all the way to the third tier.

Bisq's model is technically sophisticated, but it places a heavy operational burden on the user. Running Bisq means running a desktop application that connects to a peer-to-peer network over Tor, maintains a local wallet, and manages the trade protocol without a central server. The setup is more involved than signing up for a website. Liquidity is thinner than on centralized exchanges, which means that large trades may be difficult to fill or may execute at unfavorable prices. The security deposit requirement also means that a new user needs to acquire bitcoin before they can buy bitcoin, which is a practical barrier that custodial platforms do not impose. These are not flaws in the protocol. They are consequences of the design choices that make the protocol non-custodial.

Model Three: Lightning Hold Invoices

A third approach abandons on-chain escrow altogether and uses the Lightning Network's hold invoice mechanism. The seller issues a Lightning invoice that locks the payment in-flight without settling it. The funds are not in a multisignature address and they are not in the platform's custody. They are held by the Lightning Network routing nodes along the payment path, and they will either settle to the seller when the preimage is revealed or return to the seller if the invoice is cancelled. The escrow is temporal rather than spatial: the bitcoin is locked in a pending payment rather than in a dedicated address.

RoboSats is the most established implementation of this model. It runs over Tor, requires no registration, and assigns each user a deterministic robot avatar rather than an identity. The seller pays a hold invoice. The buyer sends fiat off-chain. When the buyer confirms the fiat payment, the preimage is revealed, the invoice settles, and the seller receives the bitcoin. If the trade fails, the invoice is cancelled and the funds return to the seller's Lightning wallet. There is no long-lived escrow address, no on-chain transaction to wait for, and no platform-held key. The privacy properties are strong: no KYC, no account database, and no persistent link between the user's identity and the trade beyond the duration of the hold.

The trade-offs are equally distinctive. Hold invoices tie up liquidity along the Lightning routing path while they are open, which makes them unsuitable for large trades. The amounts that can be traded are limited by the liquidity and channel capacity of the Lightning Network at the time of the trade. The model also depends on the user having a Lightning wallet and understanding how to manage channels and inbound liquidity, which is a higher technical barrier than using an on-chain wallet. And the dispute resolution model is thinner than Bisq's: if a dispute arises, an administrator or solver must intervene before the hold invoice expires, because the time lock on the invoice is the only mechanism that prevents the funds from returning to the seller. There is no security deposit and no multi-tier mediation process. The hold invoice is elegant, but it is a lighter-weight dispute mechanism than a bonded arbitration system.

Model Four: Nostr-Based Coordination

The newest entrants in the non-custodial P2P space combine Lightning hold invoices with Nostr, a decentralized messaging protocol, to coordinate trades without any central server. Mostro is a daemon that acts as a non-custodial escrow coordinator between buyers and sellers. Orders are published as Nostr events, trade commands are encrypted using Nostr's gift-wrap and direct-message standards, and the escrow itself is a Lightning hold invoice that Mostro never controls. Disputes are handled by an administrator or solver who reviews evidence submitted through the encrypted chat and makes a settlement decision before the hold invoice expires.

The scrow protocol takes a different Nostr-based approach. Instead of Lightning, it uses CoinJoin to fund a 2-of-3 multisignature escrow address generated from the parties' Nostr public keys, with a time lock as a fallback. The dispute resolution is collaborative when possible and arbitrated when not, and the entire coordination layer is built on Nostr keys rather than on a platform account. These projects are early-stage relative to Bisq and Hodl Hodl, and their liquidity and operational track records are correspondingly thinner. But they represent a direction of travel: the coordination layer is being decentralized alongside the settlement layer, which removes the last piece of centralized infrastructure that earlier non-custodial models still relied on.

The Limits of Dispute Resolution

Every non-custodial dispute resolution system faces the same fundamental constraint: the arbitrator or mediator is judging evidence that is partly off-chain and therefore partly unverifiable. The bitcoin side of the trade is visible on-chain or on the Lightning Network. The fiat side is not. A bank transfer, a mobile money payment, or a cash deposit leaves a record with a financial institution, not on a public ledger. The arbitrator must rely on screenshots, bank statements, chat logs, and video evidence, all of which can be forged or selectively presented.

This is why Bisq's tiered system places so much emphasis on mediation and direct communication. The protocol can enforce the movement of bitcoin, but it cannot enforce the truthfulness of a bank statement. The security deposit changes the incentive calculus — a trader with 25% of the trade amount locked in escrow has something to lose by lying — but it does not make lying impossible. A determined fraudster who expects to gain more from a successful chargeback than they lose in a forfeited deposit may still attempt the fraud. The deposit raises the cost of misbehavior; it does not eliminate the possibility.

The same limitation applies to Hodl Hodl's administrator-based resolution. The administrator can release the bitcoin to the party who presents the more convincing evidence, but the administrator is not a court and does not have subpoena power or the ability to reverse a fiat transaction. If the buyer paid with a reversible payment method and then reversed the payment after receiving the bitcoin, the administrator's release decision does not recover the fiat for the seller. The escrow resolves the bitcoin side of the dispute, not the fiat side.

This is why non-custodial P2P platforms are so restrictive about payment methods. Bisq explicitly prohibits payment systems where chargebacks are easy, such as PayPal, Venmo, and Cash App. It caps new, unsigned payment accounts at a small limit — around 0.0625 BTC for most bank methods — to limit exposure to chargeback fraud while the account builds trust. Hodl Hodl's reviewers note that reversible payment rails expose sellers to chargeback scams and that fiat rails leak identity information to the counterparty and to the bank. The payment method is not a peripheral detail. It is a central part of the security model, because the escrow can only protect the bitcoin side of the transaction.

Privacy: What “No KYC” Actually Means

The privacy claims of non-custodial P2P exchanges are often stated more broadly than the reality supports. “No KYC” does not mean that identity can never be requested. It means that identity is not required to open an account or place a trade. The triggers for identity verification differ by platform and by circumstance. Some platforms can demand identification during a dispute, which is precisely the moment when a user is least able to walk away. Others enforce a spending threshold above which verification is required. A few never ask at all. Treating “no KYC” as a binary attribute is a mistake, because the exception is where the privacy actually breaks.

Bisq's privacy model is the most structurally robust of the established platforms. There is no registration, no account database, and no central server. All peer-to-peer communication is routed over Tor, every client runs its own onion service, and trade data is end-to-end encrypted so that only the counterparties can read it. No data is stored about who traded with whom. The privacy is a property of the architecture, not a policy that the operator promises to follow. There is no central honeypot to breach or subpoena, because there is no central store of user data.

Hodl Hodl requires an email address and a password, which is a minor identity anchor but far less than the full KYC package required by regulated exchanges. The platform does not hold funds, which reduces its regulatory surface and its incentive to collect identity data. But the fiat payment itself leaks identity: a bank transfer reveals the sender's name to the recipient, and the recipient's bank details are visible to the sender. The platform can be private while the payment rail is not.

The deeper privacy question is not whether a platform collects identity documents. It is whether the trade creates a permanent link between a real-world identity and a set of bitcoin. A bank transfer creates that link regardless of the platform's data practices. A cash trade arranged in person does not. This is why some of the most privacy-preserving non-custodial models are the least technologically complex: a face-to-face cash trade via a P2P marketplace leaves no digital fiat trail at all. The trade-off is that in-person trades require physical proximity, carry personal safety risks, and do not scale.

The regulatory environment is moving toward tighter identification requirements, and this creates pressure on non-custodial platforms. LocalBitcoins and Paxful, which were once the dominant names in P2P trading, shut down between 2023 and 2025 under regulatory pressure and technical limitations. LocalBitcoins processed roughly $1.2 billion in weekly volume at its height before closing in February 2023. The platforms that have survived have either adopted a more decentralized architecture that is harder to regulate at the platform level, like Bisq, or positioned themselves as coordination layers rather than custodians. The privacy that non-custodial P2P exchanges offer is real, but it is not absolute, and it is under continuous pressure from the regulated financial system that surrounds it.

The Liquidity Problem

Non-custodial P2P exchanges have a liquidity problem that is structural rather than temporary. Custodial exchanges benefit from network effects: more users mean more liquidity, which attracts more users. Non-custodial exchanges fragment liquidity across protocols, across payment methods, and across jurisdictions. Bisq's order book is thinner than a centralized exchange's because Bisq requires users to run software and post security deposits. Hodl Hodl's liquidity is spread across 100+ fiat currencies and 300+ payment methods, which means that any individual currency pair may have very few active offers. RoboSats' Lightning-based model limits trade sizes by design because hold invoices tie up routing liquidity.

The critics of non-custodial P2P make a fair point: without volume, there is no market, and without a market, privacy is useless. A privacy-preserving exchange that nobody uses does not provide meaningful privacy to anyone. The counterargument is that liquidity is not the only measure of value. For users in jurisdictions with capital controls, for users who have been debanked or excluded from regulated platforms, and for users who simply do not want a permanent identity record attached to their bitcoin, a thinner but functional market is better than no market at all. The question is whether the non-custodial segment can grow its liquidity without compromising the architectural properties that make it non-custodial in the first place. The Nostr-based projects are an attempt to answer that question by lowering the coordination overhead while keeping the settlement non-custodial.

What the Trade-Offs Actually Mean

The non-custodial P2P landscape is not a single model with minor variations. It is a set of distinct architectures, each making a different trade-off between security, privacy, liquidity, and operational complexity. The 2-of-3 multisig model offers the most intuitive escrow and the strongest guarantee against unilateral seizure, but it depends on a platform key and lacks a built-in timeout. The 2-of-2 model with security deposits and tiered dispute resolution removes the platform's key entirely and replaces it with economic incentives and a time-locked transaction, but it demands more from the user and produces a slower, more bureaucratic arbitration process. The Lightning hold invoice model is fast, cheap, and private, but it limits trade sizes and relies on a lighter dispute mechanism. The Nostr-based models decentralize the coordination layer, but they are early and their liquidity is unproven.

None of these models solves the fiat side of the problem. The escrow can enforce the movement of bitcoin, but it cannot enforce the finality of a bank transfer or the honesty of a payment screenshot. The security deposit raises the cost of fraud, but it does not make fraud impossible. The privacy that the platforms provide at the protocol level can be undermined by the payment rail at the fiat level. These are not failures of engineering. They are boundaries of what a bitcoin-native escrow can do when one leg of the trade happens outside the bitcoin system.

For a user choosing among these platforms, the decision should turn on which failure mode matters most. If the priority is avoiding platform custody and having a clear, script-enforced escrow, the 2-of-3 model is the most legible. If the priority is removing the platform's key entirely and accepting a more complex dispute process in exchange, Bisq's model is the more rigorous design. If the priority is speed, privacy, and small trades, the Lightning-based models are the better fit. And if the priority is participating in the next generation of decentralized coordination, the Nostr-based projects are worth watching, provided the user understands that they are early-stage.

The broader point is that non-custodial P2P exchanges are not a drop-in replacement for custodial exchanges. They are a different way of trading, with different costs and different risks. The user who understands the escrow mechanism, the dispute process, and the privacy boundaries is in a position to make an informed choice. The user who treats “non-custodial” as a marketing label and assumes that all platforms work the same way is not.

Sources

• Hodl Hodl, “Hodl Hodl Multisig Escrow Explained: Why We Never Hold Your Bitcoin”.
• Bisq Wiki, “Arbitration”.
• Bisq Wiki, “Security deposit”.
• Bisq, “Bisq v1.2 Launches with New Trade Protocol and Account Signing”.
• Bisq Wiki, “Frequently asked questions”.
• Bisq Wiki, “Funding your wallet” / security deposit parameters.
• Whonix Wiki, “Bisq: The P2P Exchange Network”.
• Bisq Wiki, “Frequently asked questions” (privacy).
• Bisq network documentation, privacy and Tor.
• NoKYCZone, “Hodl Hodl Review 2026”.
• CypherpunkGuide, “Buy Bitcoin Without KYC in 2026: 5 P2P Markets Compared”.
• DEV Community, “Multisig, hold invoices and smart contracts: how non-custodial P2P escrow actually holds your coins”.
• Bisq.info, “Bisq Payment Methods — P2P Payments Without KYC Explained”.
• Miller & Chevalier, “For the average user, cryptocurrency may offer less privacy compared to offshore accounts”.
• Mostro documentation; Nostr Finance issue on Mostro.
• Search result on scrow / Nostr-based escrow.
• Search result on LocalBitcoins and Paxful shutdowns.
• Bisq DAO overview.
• Nasdaq, “Decentralized Bitcoin Exchange Bisq Has a New UI and DAO”.
• RoboSats documentation.