Escrow Risk Model
"Escrow" gets used as if it's one thing. It isn't. The eight major markets operating today implement four structurally different models, and the differences aren't cosmetic — they determine exactly how much of your money is exposed to platform-level theft at any given moment, and for how long. Below, each model is scored on buyer fund exposure — separate from operator trustworthiness — with the markets using each one mapped alongside.
What "Fund Exposure" Actually Measures
Fund exposure measures something narrower and more mechanical than operator trustworthiness: at the moment you commit funds to a purchase, how much of that money sits somewhere a dishonest operator could unilaterally take, and for how long. A market with excellent operators running a high-exposure model is still exposed if those operators are ever compromised, coerced, or replaced. Structure matters independently of intent.
The Four Models
| Model | Who Holds Funds Pre-Release | Fund Exposure | Buyer Convenience | Used By |
|---|---|---|---|---|
| Traditional wallet escrow | Market-controlled pooled wallet | High (4/5) | High — pre-loaded balance, instant checkout | DrugHub, TorZon, WeTheNorth |
| Wallet-less per-order | Order-specific address, no pooled balance | Low (2/5) | Medium — no pre-loading, but no stored balance either | Nexus |
| Direct Pay | Order-specific address, 2-hour payment window | Low (2/5) | Medium — same as wallet-less, plus time pressure | Catharsis |
| 2-of-3 multisig | Split key: buyer, vendor, market — any two release funds | Lowest (1/5) | Lower — requires multisig wallet setup | Bazaar (BTC only), DarkMatter (optional), Nexus (hybrid) |
Exposure scores run 1 (lowest) to 5 (highest) and measure the structural ability of a single party — the market — to move buyer funds without the buyer's cooperation. They say nothing about how likely any specific market is to actually do that.
Traditional Escrow — The Default, and the Highest Exposure
This is the model most market users are already familiar with: deposit crypto into a market-controlled wallet, then spend from that balance. DrugHub, TorZon, and WeTheNorth all use it. The convenience is real — no per-order friction, instant checkout from an existing balance — but the exposure is structural and constant. Every dollar sitting in your market wallet, whether it's actively tied to an order or just idle, is a dollar the operators could theoretically move. This is precisely the mechanism behind every exit scam in our market history: the market accumulates deposited balances across its entire user base, and one day those balances don't come back.
None of this means DrugHub, TorZon, or WeTheNorth are more likely to exit scam than any other market here — WeTheNorth in particular has removed early finalization specifically to reduce a different class of risk. It means the traditional model carries a standing exposure that the other three models were built to reduce or eliminate, independent of operator intent.
Wallet-less and Direct Pay — Removing the Standing Balance
Nexus's wallet-less system and Catharsis's Direct Pay solve the same core problem from slightly different angles: neither market holds a pooled balance of buyer funds at rest. You send crypto to an address generated for that specific order, funds move into escrow for that transaction alone, and there's no idle balance sitting on the platform between purchases. Nexus's system runs on the market's own schedule; Catharsis adds a hard two-hour window, trading buyer convenience for a tighter transaction lifecycle.
The exposure isn't zero — the market still generates the payment address and still controls the escrow release for that one order — but there's nothing to steal beyond whatever's actively mid-transaction at any given moment. That's a meaningfully smaller target than a platform-wide pooled wallet holding every active user's balance simultaneously.
Multisig — The Only Structural Guarantee
2-of-3 multisig is the only model where the market's cooperation isn't required to protect the buyer. Three keys exist per transaction — buyer, vendor, market — and any two can authorize a release. In a clean transaction, buyer and vendor sign together and the market's key never gets used at all. Even if the market's operators decided to exit scam tomorrow, they hold only one of three keys and cannot unilaterally move funds already in a multisig escrow.
Bazaar offers this for Bitcoin transactions specifically — Monero's architecture doesn't support the same construction natively, so Bazaar's XMR trades fall back to traditional escrow. DarkMatter offers multisig as an optional upgrade rather than the default. Nexus is the hybrid case worth flagging on its own: its wallet-less order addresses are also multisig-backed, combining the "nothing sitting idle" advantage of wallet-less payments with the "market can't unilaterally move it" guarantee of multisig — the only platform stacking both protections on the same transaction.
The trade-off is buyer-side complexity. Multisig requires understanding a wallet setup that traditional escrow doesn't, which is exactly why it remains optional rather than mandatory on every market that offers it.