Two of Three: The Multisig Contract Behind Modern Marketplaces

The phrase “2-of-3 multisig escrow” is one of those compact technical terms that does not look like it carries much weight until you understand what it removes. It removes the worst category of marketplace failure, the kind where an operator quietly closes the doors and walks away with the funds. For people who use online marketplaces that hold a balance on their behalf, this is the single most consequential structural feature on the table. This page is a plain-words walk through what the contract actually does and what changes for the people who use it.

The escrow problem

When a buyer pays a seller online, somebody has to hold the money during the gap between payment and delivery. If the seller holds it, the buyer is exposed: if the goods never arrive, the money is gone. If the buyer holds it, the seller is exposed: if the buyer claims the goods never arrived, the money is also gone. The standard fix is to put a third party in the middle. The buyer pays the third party, the seller delivers, the buyer confirms, and the third party releases the money.

This works when the third party can be trusted. For a long time, on most marketplaces, that third party was the platform operator, who held the funds in a wallet they controlled. As long as the operator stayed honest, the system worked. When the operator decided one quiet morning to close the doors, the funds in that wallet vanished with them. The category name for this outcome is exit scam, and it is the single largest source of buyer losses in the previous generation of marketplaces.

What 2-of-3 multisig does

A 2-of-3 multisig contract changes the holding arrangement. Instead of one wallet controlled by the platform, the escrow funds are locked into a contract that has three associated keys and a rule that says any two of the three must sign for the funds to move. The three keys belong to the buyer, the vendor, and the platform.

Reading the rest of this page is easier with this sentence held in your head: the platform key, alone, can move nothing.

The normal order

In a normal order, the buyer deposits, the order is placed, the contract locks the funds. The vendor ships. The buyer confirms delivery.

The buyer then signs the release transaction with their key. The vendor sees the buyer’s signature and counter-signs. Two keys, threshold met, funds release to the vendor. The platform’s key is not touched.

For the buyer this means that the happy-path order does not require trusting the platform with custody at all. The platform’s role is the matchmaking and the dispute infrastructure, not the holding of money.

The dispute path

If the order goes wrong, either party opens a dispute. The contract freezes. The platform’s arbitration panel reads the evidence both sides submit, and reaches a ruling. The platform then uses its key, the key of whichever party the ruling favours signs alongside, and the two-of-three threshold is met. Funds release per the ruling.

The losing party in a dispute cannot block the release, because two keys is enough, and the two keys are now held by the winning party and the platform that judged. The platform’s key is the tiebreaker, used only in disputed cases.

What is structurally inaccessible

Here is the property that matters. Imagine the platform wanted to walk away with all the funds in escrow. Under a single-signature model, the platform’s signature alone is sufficient to move the funds out. The platform can sign once, sweep the wallet, and disappear. Under 2-of-3 multisig, the platform’s signature is one of three, and one signature does not meet the threshold. To actually move the funds out across the open orders, the platform would need to convince a majority of the affected buyers or vendors to co-sign the release of their own funds to the platform. They are unlikely to do that.

The exit scam outcome is therefore not just discouraged. It is structurally inaccessible. The platform can fail in other ways. It can go offline. It can be slow. It can run out of moderation capacity. But it cannot quietly drain the escrow.

This is what people mean when they say multisig is the structural feature that separates the current generation of marketplaces from the previous one. The previous one was held together by trust in the operator. The current one does not require that trust for the basic custody question.

What changes for the user

Almost nothing visible.

You browse, you order, you pay. The contract runs in the background, controlled by the platform’s wallet logic and your account credentials. You notice it in one place: when a dispute is resolved, the platform may surface a small action that asks you to confirm the release, which is the user-side moment when your key signs. Most users go years without seeing this step, because most orders complete without dispute.

The deeper change is in what you can quietly assume. On a single-sig marketplace, every balance sitting in your account is a small ongoing extension of trust to the operator. On a 2-of-3 marketplace, the surface area of that trust is narrower: it covers the dispute path and the operator’s continued availability, but not the holding of the money itself. Whether you should still be careful is your decision; but the structural risk that took down the previous generation is genuinely different here.

What to look for on a real marketplace

A few things mark a marketplace that runs the multisig path properly rather than as a wrapper.

The platform should describe the contract clearly in its help documentation, not bury it under marketing copy. It should make 2-of-3 the default for vendor accounts rather than an opt-in. It should expose a visible step in the order lifecycle that corresponds to your signature on the release. And it should publish a dispute panel SLA, because the multisig structure is only as good as the arbitration process that uses the third key.

For a working example of a marketplace running this model with both Bitcoin and Monero and Litecoin as deposit options, the Nexus Market directory carries the current platform overview and the live onion address set. Every order on that platform settles through 2-of-3 by default. The structure is not exotic any more, but it is also not universal, and it remains the question worth asking first when evaluating any marketplace that holds a balance for you.

Further reading

For the deposit currency side of the same picture (which coin to fund the account with), see Funding a Tor Service: Bitcoin, Monero, and Litecoin Compared. For the user-facing habit of reaching the platform safely in the first place, the companion piece on Medium covers it. For the operator-side mechanics of mirror rotation, the Telegraph piece covers that side.