Escrow and multisignature on darknet markets

Escrow and multisignature are two mechanisms used to protect buyers and vendors on cryptocurrency marketplaces. Multisignature in particular reduces the trust placed in the marketplace operator.

In an online marketplace, escrow is an arrangement in which a third party holds payment until the buyer has confirmed receipt of the goods or until a dispute has been resolved. On darknet markets escrow and its modern successor, multisignature, address the problem that neither party trusts the other and that operators themselves have historically absconded with user funds.

Classical escrow

In the Silk Road era, escrow was implemented in the simplest possible way: buyers deposited Bitcoin into a marketplace-controlled wallet, and the operator released funds to the vendor after the buyer finalised the order. The weakness of this model was obvious: the operator held every active deposit at once and could abscond with the entire balance. A number of market closures between 2013 and 2017 — Sheep Marketplace, Evolution, BitBazaar — were classified as “exit scams” of exactly this kind.

2-of-3 multisignature

Multisignature addresses were introduced to Bitcoin through BIP 11 (2012) and pay-to-script-hash in BIP 16 (2012). Darknet markets adopted the 2-of-3 scheme from around 2013 onwards.

In a 2-of-3 escrow:

• Three parties — the buyer, the vendor and the market — each generate a public and private key;
• A multisignature script is published as the deposit address, requiring any two of the three signatures to spend;
• The buyer deposits funds to this address;
• In the normal case the buyer and vendor jointly sign to release the funds to the vendor on receipt;
• If there is a dispute, the market acts as the third signer to decide the outcome.

The operator cannot unilaterally steal the funds, because it holds only one of three required keys.

Transaction flow

1. Buyer places an order; market generates a fresh 2-of-3 address.
2. Buyer deposits BTC. The wallet does not pass through market custody.
3. Vendor is notified. Shipment proceeds.
4. Buyer confirms delivery. Buyer and vendor co-sign the release.
5. On dispute, moderators evaluate evidence (tracking, photos, PGP-signed messages) and sign on behalf of the market.

Limitations

Multisig reduces operator risk but does not eliminate it. The market still typically generates two of the three keys on its own servers; a sophisticated operator can wait to accumulate deposits that are already in the “awaiting delivery” state and then withdraw only those. Several market closures (notably Empire in 2020) have involved precisely this pattern. Multisig also increases on-chain fees and transaction complexity, which smaller markets have cited as a reason to retain classical escrow.

Monero multisig

A production-ready implementation of M-of-N multisig in Monero was merged into the reference wallet in 2020. Compared with Bitcoin, the Monero handshake is interactive and requires three rounds of key exchange, which has slowed adoption. A number of Monero-only markets have launched multisig in 2022–2024 but single-signature escrow remains common.

References

1. Andresen, Gavin et al. (2012). “BIP 11: M-of-N Standard Transactions.” github.com/bitcoin/bips.
2. Andresen, Gavin (2012). “BIP 16: Pay to Script Hash.” github.com/bitcoin/bips.
3. van Wegberg, Rolf; Verburgh, Thijmen (2018). “Lost in the Dream? Measuring the Effects of Operation Bayonet on Vendors Migrating to Dream Market.” Workshop on Technology and Consumer Protection.