When exchanges began delisting Monero, the obvious question was how anyone would acquire it. One of the answers turned out to be more interesting than the problem: atomic swaps, where you trade Bitcoin for Monero directly with another person and neither of you can run off with the funds.
No custodian. No order book operator holding your coins. No company that can be pressured into freezing your withdrawal. Just two wallets, some clever cryptography, and a protocol that makes cheating impossible rather than merely punishable.
This explains how it works — including the genuinely elegant trick that makes it possible at all — and what can go wrong.
What "atomic" means
An atomic swap either completes entirely or does not happen at all. There is no state where one side has both assets.
That property is the whole point. Trading with a stranger normally requires someone to go first, which requires trust or an escrow agent. An atomic swap removes the need for either: the protocol is constructed so that the only way for one party to take their side of the trade is to simultaneously enable the other party to take theirs.
Why Monero makes this hard
Atomic swaps between two Bitcoin-like chains are a solved and relatively simple problem. Both sides support hash timelocked contracts: lock funds so they can be claimed by revealing a secret, or reclaimed by the sender after a deadline. Reveal the secret on one chain to claim, and the other side reads it from that chain and claims too.
Monero cannot do this. It has no scripting language. There are no on-chain conditions, no hash locks, no timelocks. A Monero output is spendable by whoever holds the key, and that is the entire vocabulary.
For years this was thought to make BTC↔XMR swaps impossible. The solution, worked out around 2020, is a genuinely neat piece of cryptography.
The trick: split keys and adaptor signatures
Two ideas do the work.
A Monero key can be split. The private spend key for an address can be constructed as the sum of two secrets, one held by each party. Neither can spend alone. Whoever ends up holding both can spend immediately, with no cooperation and no on-chain condition — the money simply becomes theirs. This is how Monero gets a "lock" without any scripting: the lock is that the key is incomplete.
An adaptor signature leaks a secret when it is used. This is the clever part. You can construct a signature that is encrypted under some secret value — valid only once that secret is applied. The reverse also holds: if someone publishes the completed signature, anyone who has the encrypted version can subtract it and recover the secret.
Put those together and you get the mechanism: claiming the Bitcoin publishes a signature that reveals the missing half of the Monero key. Taking your side of the trade automatically hands the other party theirs. Not as a promise — as an unavoidable mathematical consequence of the transaction you had to broadcast anyway.
What stops someone stalling
The interesting failure case is not theft, it is abandonment. What if Alice locks her Monero and Bob simply disappears? Or Alice never claims the Bitcoin, leaving both sets of funds stuck?
The Bitcoin side handles this with layered timelocks, because Bitcoin can express deadlines even though Monero cannot:
- A cancel window. If the swap has not completed by a deadline, the Bitcoin side can be moved into a cancelled state.
- A refund path. Once cancelled, Bob can reclaim his Bitcoin — and crucially, doing so reveals his half of the Monero key to Alice, so she gets her Monero back. The same secret-revealing mechanism runs in reverse for the unwind.
- A punish path. If Bob cancels but then refuses to complete his refund, leaving Alice's Monero locked, a second deadline lets Alice take the Bitcoin outright.
The result is that walking away is never profitable, and the party who stays online and follows the protocol always ends up whole.
This is why you must stay online. Those deadlines are real and they run whether your computer is on or not. Closing your laptop in the middle of a swap is the single most common way people get into trouble — not losing funds outright, usually, but ending up in a recovery path that requires you to come back and finish. Start a swap when you can leave it running.
What it looks like in practice
The reference implementation of BTC↔XMR swaps came out of the COMIT project as a command-line tool, and there is now a graphical client — commonly known as UnstoppableSwap — that most people use instead.
The model is maker/taker. Makers run a service advertising a rate and holding Monero liquidity. Takers are ordinary users with Bitcoin who pick a maker and execute a swap. You do not need to find a specific counterparty yourself; the client shows available makers and their rates.
From a taker's perspective it is roughly: install the client, browse available offers, pick one, provide a Monero address to receive to, fund the Bitcoin side, and wait. The wait is real — you are waiting on confirmations on two chains — so plan for tens of minutes rather than seconds.
Software maturity: atomic swap tooling is functional and used daily, but it is younger and rougher than exchange software, and the protocol has genuine edge cases around timing. Do a small swap first to learn the flow before committing an amount you would mind babysitting through a recovery path.
The real risks
Not the risk of theft, which the protocol handles. These:
Price and spread. Makers quote a rate that includes their margin and their risk. It is frequently worse than a centralised exchange's spot price. You are paying for the absence of a custodian, and sometimes that premium is substantial. Compare a few makers.
Liquidity. Maker depth varies. Large swaps may not be fillable at a reasonable rate, and you may need to split them.
Fees on both chains. You pay Bitcoin fees, which can be significant during congestion, plus a small Monero fee. Factor this in for small swaps — below a certain size the fees eat the point.
Time. Both chains must confirm. This is not an instant trade.
Recovery complexity. If something goes wrong you may need to resume the swap from the client's saved state. The tooling handles this, but it requires you to actually come back and do it.
Counterparty availability, not counterparty honesty. A maker cannot steal from you. A maker can go offline and cost you time and fees while the protocol unwinds.
The privacy caveat nobody mentions
This one matters and it is easy to miss.
An atomic swap does not launder the Bitcoin side. The Bitcoin chain permanently records that a specific amount left your identified address at a specific time. If those coins came from a KYC exchange, that link is intact and public forever. Swap transactions also have a somewhat recognisable structure on the Bitcoin side.
What the swap gives you is that the Monero side is private from that point onward — nobody can see where the XMR went or what you did with it. That is genuinely valuable, and it is a smaller claim than "untraceable acquisition". If you are relying on it, be clear about which half is protected. Our post on Monero's traceability covers why the ends of a chain of custody are usually the weak point.
Alternatives
Haveno is a decentralised peer-to-peer exchange for Monero, running over Tor. It works differently from atomic swaps — trades are secured with multisig and a dispute-arbitration system rather than pure cryptographic atomicity — but it supports fiat trading, which atomic swaps cannot. Different tool, different trade-offs, worth knowing about.
Instant swap services (the "no account, send coins here" type) are quick and easy. They are also custodial for the duration of the trade, often log more than they admit, and have been known to freeze funds and demand identity documents after the fact. Convenient, but you are trusting a company again.
Peer-to-peer trading directly with a person you find in a community, using an escrow you both accept. Works, entirely dependent on the people involved.
Mining, which produces XMR that never touched an exchange at all. Not fast, but real — we cover the arithmetic here.
Why this matters beyond convenience
The strategic point is bigger than any individual trade.
Delisting Monero from centralised exchanges was intended to restrict access. Atomic swaps demonstrate that access to a cryptocurrency does not actually depend on exchanges listing it — as long as one liquid, widely-traded asset exists, anything that can swap against it remains reachable. There is no operator to serve an order on, no company to shut down, and no order book to seize.
That is not a small thing. It is the difference between a currency that exists at the pleasure of intermediaries and one that does not.
The short version
- Atomic swaps trade BTC for XMR directly, with no custodian and no possibility of theft by either side.
- Monero has no scripting, so the lock is a split key rather than an on-chain condition.
- Adaptor signatures mean claiming one side reveals the secret that unlocks the other — the two actions are inseparable.
- Bitcoin-side timelocks handle abandonment, with cancel, refund and punish paths so nobody can profit by stalling.
- Stay online for the duration; the deadlines run regardless.
- Costs are real: maker spread, two sets of chain fees, and time.
- The Bitcoin side stays public. Privacy starts at the Monero half, not before it.
Once the XMR arrives, it lands in whatever wallet address you nominated. If you want somewhere to receive it that requires no installation and never sees your spend key, our browser wallet will do — and if you would rather not hand anyone a view key at all, run the server yourself.