Conventional escrow carries a paradox at its center: to protect a buyer from a dishonest seller, both parties hand the money to a third party — the platform itself. When that platform is hacked, seized, or simply vanishes with the deposits, the protection mechanism is what took the funds. A 2 of 3 multisig escrow removes the custodian: the deal's coins sit on an address with three keys — buyer, seller, and an arbiter — and moving them takes any two of the three signatures.
No single party can take the money, and a platform's insolvency stops being a threat to funds in flight. What follows is how the three-key model compares with the custodial default, what each signing pair can do, how the construction differs between Bitcoin and Monero, and where it honestly fails — multisig narrows the trust requirement rather than deleting it.
Updated
Read the columns as a trade: FE swaps every buyer protection for convenience, custodial escrow concentrates all risk in the platform's solvency and honesty, and multisig removes the single point of failure at the price of making the arbiter the pivot of every dispute — plus a workflow that punishes carelessness. Which risk you prefer is the actual decision.
Three keys go in, any two signatures release — and the arbiter only ever acts in a dispute
Before any coins move, the three parties generate keys and exchange the public side: in Bitcoin the three extended public keys are sorted into a 2-of-3 script, in Monero the wallets run a few rounds of cryptographic message exchange. The result is a shared deposit address no one controls alone. The buyer funds it, and from that point the deal can end exactly three ways.
Buyer + Seller — the normal end
Goods arrived, both sides co-sign the payout: the buyer signs, the seller countersigns, the transaction broadcasts. The arbiter never touches the deal — in Bitcoin the handoff is a half-signed PSBT file passed between wallets, in Monero an exported multisig txset.
Buyer + Arbiter — refund
The seller never shipped. The buyer opens a dispute, the arbiter reviews tracking, messages, and the payment window, then puts the second signature on a refund transaction back to the buyer. The seller watches it happen with no way to block it.
Seller + Arbiter — release
Delivery is provable but the buyer ghosts or disputes in bad faith. The arbiter co-signs the release to the seller instead. Same machinery, opposite output — the arbiter's second key is what turns evidence into a verdict the blockchain enforces.
Bitcoin's is simpler to build and public to read; Monero's is invisible on-chain and fiddlier to run
Bitcoin makes the easy part easy: three parties exchange extended public keys once, the wallet software derives a single shared address from a sorted 2-of-3 script, and each spend is a partially signed transaction — a PSBT, standardized in BIP-174 — passed from signer to signer. The descriptor for the whole arrangement fits on one line:
wsh(sortedmulti(2,xpubA.../0/*,xpubB.../0/*,xpubC.../0/*))
The cost is transparency. Until the first spend the address is just a hash, but the moment funds move, the witness data publishes the full 2 <A> <B> <C> 3 script for anyone to read — the escrow construction, the signing pattern, the amounts. On a transparent ledger, using multisig is itself a visible fact.
Monero inverts the trade. Its multisig is indistinguishable from an ordinary transaction on-chain — every Monero spend is already a ring signature, so observers cannot tell that an escrow ever existed. The price is a fussier setup: the three wallets must exchange cryptographic setup material over several rounds before the shared address exists:
# in each of the three wallets, monero-wallet-cli:
prepare_multisig # share the "MultisigV1..." string
make_multisig 2 <info_peer_1> <info_peer_2> # round one
exchange_multisig_keys <info_peer_1> <info_peer_2> # 2-of-3 needs this extra round
# spending: export_multisig_info → import_multisig_info → sign_multisig → submit_multisigThe commands above come straight from the Monero project's wallet documentation, which details the round counts for other thresholds as well. If hiding the escrow's very existence matters to the deal, only one of the two chains can do it — the protocol-level reasons are the subject of our Monero vs Bitcoin privacy comparison.
The construction removes one custodian — it does not remove trust
The reflex is to treat 2-of-3 as armor. It is better read as a trust transfer: the single point of failure moves off the platform's wallet and onto the arbiter's honesty plus everyone's key hygiene. Three failure modes survive the cryptography.
Two keys collude. Seller plus a dishonest arbiter holds both signatures the script needs; the buyer watches the release sign itself with no recourse. Multisig never deleted trust — it replaced "the platform is honest" with "at least one of two independent parties is honest", and a corrupted arbiter turns the dispute mechanism into the theft vector.
A key is lost mid-deal. The good news: one lost key does not lock the deposit — the surviving pair can still sign, which is precisely why 2-of-3 beats 2-of-2, where a dead seed bricks the funds permanently. The bad news: the party that lost the key loses its vote. If the buyer's seed file dies mid-dispute, seller and arbiter decide alone, so key hygiene is dispute insurance and not just wallet hygiene.
Public keys get swapped at setup. The initial three-way exchange is the one moment that must be authenticated: substitute an xpub in transit and an attacker's key takes a voting seat in the script, or the deposit address itself becomes one they co-control. Setup material should travel signed and fingerprint-checked — the OpenPGP verification workflow is exactly the check that defeats it.
None of this matters if the escrow address itself came from a phishing clone, which is what the PGP-verified address reference on the homepage is for; buyer-side questions on escrow behavior sit in the TorZon market FAQ. Multisig is the strongest settlement model the tooling offers — and it still assumes you verified everything it cannot.