Best for: Buyers who want no-KYC Lightning trades for small to mid-sized amounts and are comfortable living inside Tor.
Consider if: You value privacy enough to run a hold-invoice-capable wallet and double-check payment rails before committing fiat.
Not ideal when: You need large clips, fiat chargeback protection, or hands-on support from a regulated desk.
Gotcha: Lose that token and support cannot reopen the contract or disputes for that robot.
Gotcha: Hold invoices time out fast, so stay connected until the contract room opens.
Gotcha: If a counterparty stalls, hit Dispute before the timer ends so the coordinator can review evidence.
Maker bond: defaults to ~3% (min 20,000 sats, adjustable to 20%)
What happens:
RoboSats locks that bond in a Lightning hold invoice until the contract completes or you cancel.
Save money:
Lower the bond slider only when you trust the payment rail and keep orders short so capital is not locked for long.
See Quick Start → Contracts for bond calculations and timers.
Taker bond: matches the maker percentage (usually ~3%)
What happens:
You pay the hold invoice when you join the order and get it back automatically once both sides confirm fiat.
Save money:
Join orders you can settle immediately to avoid timeout penalties and re-post fees.
Documentation explains countdown rules, refunds, and when bonds forfeit.
0.2% total (0.1% maker + 0.1% taker) charged when escrow settles
What happens:
The coordinator collects the fee from the escrowed sats as the hold invoice finalizes.
Save money:
Place maker orders with tight spreads so you earn the spread instead of paying a wider markup.
Quick Start → Fees lists the split and how coordinator donations offset costs.
Bonds auto-refund when both sides confirm fiat or if you cancel before the hold invoice is charged. That timer is enforced by the coordinator, so you can exit early if a counterparty disappears.
Makers can slide the bond from 0% to 20% before publishing, with 3% as the default. Raising it discourages chargeback-prone rails, and you can lower it only when you trust the fiat method.
Each side pays the routing cost on the Lightning invoices they settle, which is usually just a few sats. You can keep fees negligible by using well-connected wallets or running your own node.
Best for: Trades with documented fiat rails and a clear paper trail.
| Min per transaction | Set by maker (often ≥ 50,000 sats) |
|---|---|
| Max per transaction | Set by maker; Lightning routes typically < 5,000,000 sats |
| Max per day | Varies by counterparties |
| Max per week | Varies by counterparties |
| Withdrawal eligibility | Once both parties mark fiat received |
Best for: Cross-border fast payments when both peers use the same fintech app.
| Min per transaction | Set by maker (often ≥ 50,000 sats) |
|---|---|
| Max per transaction | Set by maker; Lightning routes typically < 5,000,000 sats |
| Max per day | Varies by counterparties |
| Max per week | Varies by counterparties |
| Withdrawal eligibility | Once both parties mark fiat received |
Best for: Local trades with trusted meetups or repeat partners.
No platform custody Bonds keep peers honest
When you publish an order, the sats stay in a Lightning hold invoice anchored to your wallet instead of a custodian. That means nothing moves until both sides mark the fiat leg complete, and the payout lands in your balance the instant the contract clears.
Gotcha: Keep your Lightning wallet online; hold invoices expire quickly if the coordinator has to wait.
One-time avatars per trade Stored client-side only
Each session mints a robot avatar from the token you save instead of an email or ID. That keeps every order tied to a disposable alias, and you can spin up a fresh robot for the next trade so past deals stay compartmentalized.
Gotcha: Misplacing the token severs dispute access for that robot, and support cannot restore it.
Onion routing by default Clearnet is fallback only
Routing the session through Tor bounces your packets through onion relays before they ever reach the coordinator. That keeps your IP and location out of the logs, with the clearnet bridge reserved as a last resort when Tor or I2P is blocked.
Gotcha: The clearnet gateway sits behind Cloudflare; stick to Tor when privacy is the priority.
Lightning wallets that support hold invoices keep RoboSats bonds alive while fiat clears.
Gotcha: Critical: Do NOT use custodial wallets like Wallet of Satoshi. They cannot handle Hold Invoices, and you may lose your bond.
RoboSats pays the trade out to the invoice you present, so you control where the sats land.
Gotcha: Never reuse an invoice; the coordinator rejects duplicates to protect you from replay attacks.
Testing with a tiny order lets you confirm your wallet, Tor setup, and payment rail before scaling up.
Gotcha: Skipping test trades raises the chance you discover a wallet or rail issue during a larger order.
Moving sats off your hot Lightning wallet preserves sovereignty and limits coordinator exposure.
Gotcha: Leaving large balances in a hot Lightning wallet invites device loss and liquidity drains.
RoboSats itself is Lightning-only, but you can set up a Boltz or Deezy swap after payout to land coins on-chain.
Regenerate the invoice inside the room and ask the seller to repost; the coordinator keeps the bond active while you refresh it.
Check your wallet balance and verify the payment hash matches the contract details; you can also watch it settle on your node or Lightning explorer.
When you use Tor or I2P the coordinator never sees your IP; only the optional clearnet gateway collects standard web logs.
Yes. Clear your browser storage or hit Delete robot, and only your local token copy remains.
Trades pause until the coordinator returns; keep your wallet online and watch the RoboSats Matrix status channel for updates.
Full codebase published under AGPL-3.0 license for anyone to audit, fork, and self-host.
Source codePrivacy guide covers Tor access, PGP chat, and operational security expectations for every trade.
Privacy guideNon-custodial Lightning escrow is documented in the Quick Start so anyone can verify how funds stay outside the coordinator.
How it works
RoboSats is a privacy‑first, Lightning‑native peer‑to‑peer exchange for buying and selling bitcoin with fiat. It is open‑source, requires no registration or KYC, and runs primarily over Tor (with I2P ...
RoboSats is a privacy‑first, Lightning‑native peer‑to‑peer exchange for buying and selling bitcoin with fiat. It is open‑source, requires no registration or KYC, and runs primarily over Tor (with I2P and an Android app available). Each trade uses a one‑time “robot” identity tied to a secret token you control, and all peer chat is end‑to‑end encrypted with PGP. The flow is simple: make or take an order, both sides lock small Lightning bonds, the seller locks a Lightning hold‑invoice escrow, fiat moves, then sats are released.
Each contract starts with the maker posting a Lightning hold-invoice bond—defaults to ~3% of the trade—and the taker matching it when they join, while the seller locks the sats in a hold invoice escrow. That lock keeps funds frozen until both parties confirm fiat, which means you can complete the trade and reclaim everything or cancel during the timer if the peer stalls.
RoboSats collects 0.2% per completed trade, split 0.1% to the maker and 0.1% to the taker when the hold invoice settles. That sits on top of whatever spread you negotiate, so you can tighten your offers to keep the total cost in sats low.
Instead of accounts, RoboSats generates a one-time robot avatar from a secret token you control and stores only that token locally. That keeps your personal data off the coordinator, and you can rotate a fresh robot for every trade to keep orders unlinkable.
You need a Lightning wallet that can issue invoices and hold payments for a few minutes; RoboSats docs highlight Zeus, Blixt, Phoenix, Breez, Mutiny, and BlueWallet (LDK) because they keep the bond open until fiat clears. That support prevents premature expiry, and you can keep a second wallet with inbound liquidity ready if your main one is routing a large trade.
If fiat fails, you hit Dispute in the chat, upload the payment proof, and the coordinator reviews both bond invoices plus your evidence. Their ruling routes the trade hold invoice either to you or the counterparty, so you can recover funds when you documented the fiat leg.
