A peer-to-peer (P2P) Bitcoin exchange lets you buy directly from another person instead of from a company that asks for your ID (KYC, “know your customer”). No exchange database then ties the coins to your name, as long as you never hand the platform your ID or bank statements. Platforms such as Bisq, HodlHodl and RoboSats protect the trade in different ways: an escrow that locks the seller’s bitcoin before you pay, deposits that a cheater loses, and the seller’s reputation.
The platform is only part of your privacy. How you reach it, what your bank transfer says, which address you receive to and what you later spend the coins with can each give it away. This guide walks you through a trade, from choosing a platform to keeping the new coins apart, then covers the most common mistakes.
Step-by-Step Guide
Step 1: Select a P2P platform based on your privacy and security requirements. The major P2P Bitcoin exchanges serve different needs. Bisq is fully decentralized—it runs as desktop software connecting directly to other traders via Tor with no central server. Bisq requires no registration and provides the strongest privacy, but has lower liquidity, and it now comes as two apps. Bisq Easy, in the Bisq 2 app, needs no bitcoin to start, but it has no escrow: you pay first and rely on the seller’s reputation. Bisq 1 uses a Bitcoin 2-of-2 multisig escrow and asks both sides for a security deposit in Bitcoin, so you need some bitcoin before you can buy. HodlHodl is a non-custodial web platform using multisig escrow without holding user funds, and it asks for an email address to create an account. It keeps your trades, chats and payout addresses for five years after your last activity, and in a dispute it can ask for your ID and bank statements. RoboSats operates on the Lightning Network for fast, small trades with no account, though both sides lock a small bond in sats. Evaluate each platform’s liquidity in your local payment method, fee structure, and privacy guarantees before committing.
Step 2: Prepare your trading environment for privacy. Before placing any trade, configure your privacy infrastructure. Install and verify the Tor Browser or configure a system-wide Tor connection. Access web-based P2P platforms exclusively through Tor to prevent IP address leakage. For Bisq, the application routes through Tor by default—verify this in settings. Use a dedicated email address, created over Tor with a privacy-respecting provider such as Proton Mail or Tuta (formerly Tutanota), for any platform that requires registration. Never access P2P trading platforms from the same browser session or IP address you use for KYC exchanges, social media, or personal email. This compartmentalization prevents correlation attacks that could link your identity to your P2P trades.
Step 3: Fund your escrow and create or accept a trade. On most P2P platforms, the Bitcoin seller locks the BTC in an escrow before the trade begins; Bisq Easy is the exception, where you pay first. If you are selling Bitcoin, initiate the escrow deposit and wait for confirmation. If you are buying, browse available offers and select one that matches your desired amount and payment method. Where the platform shows the seller’s reputation, check it: on HodlHodl, a high rating over many completed trades; on Bisq Easy, a high reputation score. RoboSats has no seller reputation, because each robot is meant for a single trade; there the locked escrow and both bonds protect you. On Bisq 1, both buyer and seller lock security deposits into the escrow, creating mutual incentive to complete the trade honestly. On HodlHodl and Bisq 1, wait until the escrow deposit shows as confirmed before you send any money: the platform displays its status, and you can look the transaction up on a block explorer.
Step 4: Execute the fiat payment with operational security discipline. When paying for Bitcoin via bank transfer, cash deposit, or other fiat methods, follow these operational security rules: never include “Bitcoin,” “BTC,” “crypto,” or similar keywords in payment references, and write only what the platform’s rules allow. On Bisq 1 the app asks you to leave the field empty and never to write the trade ID; if a reference is required, use your name or a dash. Bisq Easy asks you to leave it blank if possible, or to write your name. For bank transfers, be aware that your bank may flag or inquire about payments to unfamiliar accounts. Cash-in-person trades offer the strongest privacy but require meeting in public places and exercising physical safety precautions. For online payment methods, use accounts that minimize identity linkage to your Bitcoin activity. After sending payment, mark the trade as paid in the platform and upload any required payment proof.
Step 5: Verify escrow release and secure your purchased Bitcoin. After the seller confirms receipt of your fiat payment, the escrow releases the Bitcoin to your wallet (on Bisq Easy, the seller sends it directly). Verify the payout in your wallet. For an on-chain payout, look the transaction up on a block explorer and don’t consider the trade complete until it has at least one confirmation (for large amounts, wait for three or more). A Lightning payout, as on RoboSats or from some Bisq Easy sellers, never shows on a block explorer: it is complete once your wallet shows the invoice as paid. If the seller does not confirm payment receipt within the platform’s timeout period, open a dispute under the platform’s rules. Cash handed over in person is the exception: HodlHodl doesn’t mediate trades that use its in-person payment method, so the bitcoin reaches you only if the seller releases it, and Bisq’s mediators often can’t settle face-to-face disputes. Don’t part until the seller has confirmed receipt on the platform. Have the Bitcoin sent straight to a fresh address in your own wallet. If it lands in a wallet built into the trading app instead, move it to your long-term storage soon: that protects the coins, but the move is public on the blockchain and doesn’t hide where they came from.
Step 6: Post-trade privacy hygiene. After completing a P2P trade, keep the new coins apart from the rest of your holdings. The seller still knows the address they paid, and after a bank transfer your name too. If that link matters to you, send the coins through a CoinJoin round (the CoinJoin lesson covers the tools that still work in November 2026) and spend the mixed coins on their own. Lightning is another route: open a channel with these coins, then pay the sats over Lightning to a different wallet of yours. The channel opening is an ordinary on-chain transaction linked to these coins; the Lightning payment itself stays off the blockchain, though your channel partner can usually tell it came from you (the chain analysis lesson covers what Lightning hides and what it doesn’t). Label the new UTXOs in your wallet with their source (e.g., “Bisq trade, June 2026, non-KYC”) for future UTXO management and privacy planning. Never combine non-KYC Bitcoin with Bitcoin withdrawn from KYC exchanges in the same transaction, as this contaminates the privacy of both sets of coins.
Common Mistakes to Avoid
Including cryptocurrency references in fiat payment descriptions. Writing “Bitcoin,” “BTC,” “crypto,” or anything similar in bank transfer references is one of the most common and consequential P2P trading mistakes. Banks monitor payment descriptions and can flag, freeze, or close accounts associated with cryptocurrency-related transfers. Even after the account is restored, you may be placed on enhanced monitoring. Write only what the platform’s rules allow: nothing or your name on either Bisq app, and never the trade ID on Bisq 1. Some banks are more crypto-friendly than others—research your bank’s policies before making P2P trades via bank transfer.
Trading with low-reputation or new accounts. The reputation system is your primary defense against scams on P2P platforms. New accounts with zero trade history are significantly more likely to be scammers or bad actors. On Bisq, check the trader’s account age and trade history. On HodlHodl, review the counterparty’s completed trade count, dispute rate, and average rating. While everyone starts with zero reputation, limit your exposure to new accounts by trading only small amounts until the counterparty has proven reliable. Never override platform warnings about unverified or low-reputation traders for the sake of a slightly better exchange rate.
Reusing Bitcoin addresses across multiple P2P trades. Providing the same receiving address for multiple P2P trades allows anyone (including your counterparties) to see your complete P2P trading history and estimate your total Bitcoin holdings. Always generate a fresh receiving address for each trade. Most wallets do this automatically, but verify that you are not manually entering a previously used address. For sellers, use coin control features to select specific UTXOs for each escrow deposit rather than letting the wallet choose automatically, preventing accidental linkage between trades.
Skipping the Tor requirement for web-based platforms. Accessing HodlHodl, RoboSats, or other web-based P2P platforms without Tor exposes your IP address to the platform operator and potentially your counterparties (depending on the platform architecture), and shows your internet provider which platform you use. Your IP address can be correlated with your trades, payment methods, and ultimately your identity. Even if the platform claims not to log IP addresses, you cannot verify this claim. Always use Tor for accessing P2P trading platforms—the minor inconvenience of slower page loads is insignificant compared to the privacy protection it provides.
Neglecting to separate P2P acquired Bitcoin from exchange Bitcoin. Mixing non-KYC Bitcoin purchased through P2P platforms with KYC Bitcoin withdrawn from exchanges destroys the privacy benefit of the P2P purchase. When you combine UTXOs from both sources in a single transaction, blockchain analysis can infer that the same entity controls both, linking your KYC identity to your formerly private P2P coins. Maintain separate wallet accounts or entirely separate wallets for KYC and non-KYC Bitcoin, and never spend from both in the same transaction.
Frequently Asked Questions
Is it legal to buy Bitcoin through peer-to-peer exchanges?
In most jurisdictions, buying Bitcoin through peer-to-peer platforms is legal. Bitcoin is property, and buying property from another person privately is a standard commercial activity. However, regulations vary significantly by country. Some jurisdictions require P2P platforms to implement KYC procedures above certain transaction thresholds. Others restrict certain payment methods for cryptocurrency purchases. Sellers who operate as regular businesses (high volume, public offers) may face money transmission licensing requirements in some jurisdictions. As a buyer making occasional personal purchases, P2P trading is legal in the vast majority of countries. However, you remain responsible for any applicable tax reporting obligations on gains when you later sell or spend the Bitcoin.
How does the escrow system prevent scams on P2P platforms?
The escrow system locks the seller’s Bitcoin in a multisig transaction before the buyer sends fiat payment. On Bisq 1, this is a 2-of-2 multisig between the buyer and seller, with a mediator available if both parties disagree. On HodlHodl, it is a 2-of-3 multisig between buyer, seller, and the platform (which acts as arbitrator). Bisq Easy, in the Bisq 2 app, has no escrow: the buyer pays first and relies on the seller’s reputation. The escrow ensures the seller cannot sell the same Bitcoin to multiple buyers, and the buyer knows the Bitcoin exists and is locked before sending payment. If a dispute arises, HodlHodl’s support team weighs the evidence (payment proofs, transaction records) and signs the payout with the winning trader. On Bisq 1, a mediator only proposes a payout that both traders must sign; if one refuses, the escrow goes to the Bisq DAO after a time lock and an arbitrator reimburses the honest trader. This way neither party has to trust the other, though both rely on the platform’s mediators or arbitrators if a dispute arises. Cash handed over in person is the weak spot: there is little evidence to judge, and HodlHodl doesn’t mediate those trades at all.
What is the price premium on P2P exchanges compared to centralized exchanges?
P2P Bitcoin usually costs a few percent more than the price on a centralized exchange, and the premium varies with the payment method, the currency, the region and demand. It compensates sellers for the convenience of accepting various payment methods, the risk of payment reversals (especially with methods like PayPal or Venmo), and the privacy benefit to buyers who acquire non-KYC Bitcoin. Reversible payment methods carry higher premiums because of that chargeback risk. In regions with limited centralized exchange access, premiums can be higher. The premium is the economic cost of privacy—buyers pay more to avoid KYC identity linkage, and sellers charge more for accepting the additional risk and effort of P2P trading.
Can I use the Lightning Network for P2P trading?
Yes. RoboSats is specifically designed for Lightning-based P2P trading, enabling fast settlement of small-to-medium trades without on-chain transaction fees. The Lightning Network’s native privacy properties (onion-routed payments not visible on the public blockchain) make it particularly attractive for private P2P trades. On Bisq Easy, some sellers also deliver over Lightning. The main limitations of Lightning-based P2P trading are channel capacity constraints (limiting maximum trade sizes) and the requirement for both parties to have active Lightning nodes or wallets. For trades under the Lightning channel capacity limit, it offers faster settlement and lower fees compared to on-chain P2P trades.
What should I do if my bank freezes my account after a P2P trade?
If your bank freezes your account, contact their compliance department immediately and cooperate with their inquiry. Explain that you made a personal purchase from another individual, answer their questions truthfully, and provide any requested documentation (transaction receipts, proof of the payment’s purpose) calmly and promptly. Going forward, consider using a separate bank account for P2P trading activities, or switch to payment methods less likely to trigger bank flags (cash-by-mail, in-person cash trades, or specific payment apps known to be more crypto-tolerant). Some users proactively inform their bank about expected incoming and outgoing payments to personal contacts to prevent automated freezes.
Related Resources
- Buying Bitcoin Without KYC: RoboSats, Bisq and P2P Exchanges
- Bitcoin Mining as Non-KYC Acquisition
- KYC vs Non-KYC Bitcoin: Privacy Paradox
- Bitcoin Acquisition: Privacy and Security
- CoinJoin and UTXO Segregation Deep Dive
