Glossary / Transactions & fees
Escrow contract
- Definition
- An escrow contract locks bitcoin in an output that neither trading party can spend alone, releasing it only when both agree or a named third party breaks the tie.
The usual construction is a two-of-three multisig: buyer, seller, and arbitrator each hold a key, and any two of the three can move the money. Bitcoin has been able to express this since pay-to-script-hash activated on April 1, 2012, with timelocked refund branches available since BIP65 in December 2015. Most platforms that use the word escrow do none of it.
How it works
An escrow contract is a spending condition written into the coin itself, not a promise recorded in a company's database.
The funding transaction pays to a script that names three public keys and a threshold of two. On a clean trade the arbitrator never appears: buyer and seller sign the release between them, and the third key stays in a drawer. On a disputed one, the arbitrator reads the evidence and signs alongside whichever side wins, which is enough to reach the threshold. One signature out of three moves nothing, so an arbitrator acting alone cannot take the coins. The exposure that remains is collusion, where the arbitrator supplies the second signature to a cheat.
A well built contract also has an exit for the case where nobody signs anything. OP_CHECKLOCKTIMEVERIFY, enforced from block 388,381 in December 2015, lets the script carry a branch that returns the coins to the funder alone once an agreed block height passes. Its relative cousin OP_CHECKSEQUENCEVERIFY counts a delay from the moment the funding confirms instead of naming a fixed height. Without one of these, a counterparty who stops answering email freezes the money permanently.
The cost is two transactions, and the second one is fat. A two-of-three witness script runs 105 bytes on its own, so spending a segwit escrow output costs roughly 105 virtual bytes against 68 for an ordinary single key input. Funding and releasing a trade therefore comes to close to 6,000 satoshis at 20 sat/vB. Escrow makes sense for a deal worth hundreds of dollars and no sense at all for small change, which is why the better designs also ask both sides to lock a security deposit: cheating has to cost the cheat more than the trade is worth.
Where you see it
Escrow contracts appear wherever two strangers exchange something for bitcoin and neither will go first.
Peer-to-peer marketplaces are the common case, and there is a simple test for whether the escrow is real. Ask for the address. A genuine contract funds a normal on-chain address that you can paste into a block explorer and watch confirm before you part with anything, and the script it commits to is public. If all you get is a balance on an account page, the coins are in the platform's own wallet and you are trusting its solvency and its regulator, not bitcoin. That distinction is not academic: LocalBitcoins held customer funds that way and shut down in February 2023, and Paxful Holdings pleaded guilty to federal charges on December 9, 2025.
The stronger marketplace designs keep one key of three and stay unable to move anything without a trader's agreement. Private sales use the same shape with a lawyer or a mutually trusted engineer as the third keyholder. Lightning borrows it too: a channel funding output is a two-of-two that neither side can spend alone, with timelocked penalties standing in for the arbitrator.
Escrow contract vs HTLC
An escrow contract needs a human to break a tie; a hash time-locked contract needs nobody, because the referee is a secret. An HTLC pays out automatically to whoever reveals the right preimage before a deadline, which works only when both halves of the trade sit on ledgers that can check the same hash. A bank transfer cannot be locked behind a hash, so any trade of fiat for bitcoin ends up needing either an arbitrator or a custodian. Escrow contracts are what you reach for when one side of the deal happens off-chain.