Overview
Escrow is a mechanism for facilitating trustless or trust-minimized trades between parties who do not know each other. In Bitcoin, escrow can be implemented natively using multisig scripts, eliminating the need for a traditional escrow service to take custody of funds. The most common pattern is a 2-of-3 multisig arrangement where the buyer, seller, and an arbitrator each hold one key.
How 2-of-3 Escrow Works
Participants:
Alice (Buyer) - Key A
Bob (Seller) - Key B
Carol (Arbitrator) - Key C
┌─────────────────────────────────────────────┐
│ 2-of-3 Multisig Escrow │
│ Requires any 2 of 3 keys to spend │
├─────────────────────────────────────────────┤
│ │
│ Happy path (no dispute): │
│ Alice + Bob sign → Bob receives payment │
│ (Carol is never involved) │
│ │
│ Dispute - buyer wins: │
│ Alice + Carol sign → Alice gets refund │
│ │
│ Dispute - seller wins: │
│ Bob + Carol sign → Bob receives payment │
│ │
│ Key property: Carol alone CANNOT │
│ steal the funds (needs a 2nd key) │
└─────────────────────────────────────────────┘
Advantages Over Traditional Escrow
- Non-custodial: No single party controls the funds. The arbitrator alone cannot move the bitcoin.
- Transparent: The escrow terms are encoded in a Bitcoin script, verifiable by all parties
- Censorship-resistant: The escrow exists on the Bitcoin network and cannot be seized by a third party
- Global: Works across borders without relying on any legal jurisdiction
Use Cases
- Peer-to-peer trading: Platforms like Bisq use escrow mechanisms for fiat-to-bitcoin trades
- Freelance payments: Funds are released upon delivery of work
- Physical goods: Payment is held until the buyer confirms receipt
- Domain name sales: Escrow protects both buyer and seller in digital asset transfers
Advanced Escrow Patterns
Beyond simple multisig, Bitcoin supports more sophisticated escrow patterns:
- Timelocked escrow: Funds automatically return to the buyer after a timeout if the seller does not claim them, using timelocks
- Hash-locked escrow: Release is conditional on revealing a secret (preimage), useful for atomic swaps
- Taproot escrow: Using Taproot, the happy path (mutual agreement) looks like an ordinary single-signature transaction, saving fees and improving privacy
Common Misconceptions
- The arbitrator in a 2-of-3 escrow does not hold the funds. They only hold one of three keys and cannot unilaterally move the bitcoin.
- Escrow does not eliminate all trust -- you still need to trust that the arbitrator will rule fairly in disputes. However, the arbitrator's power is strictly limited to choosing between the two parties.
- On-chain escrow transactions pay normal mining fees; the escrow mechanism itself is free.