Escrow is the one feature that has been rebuilt from scratch twice, and each rebuild followed a period of people losing money in a predictable way.
Payment went into an account the market controlled and the market promised to pass it on. That is not escrow in any meaningful sense, it is custody with good intentions, and it failed the way custody without accountability always fails.
Markets added dispute procedures, staff and published policies while still holding funds in one pool. Better for ordinary disputes, unchanged for the case that actually destroys people, which is the operator going away with everything at once.
Each order locks into an address requiring two of three keys, held by buyer, vendor and market separately. The operator can break a tie in a dispute and cannot move funds alone. This is the current design and the reason it is worth understanding is that it changes what happens on the worst day rather than a normal one.
| Generation | Fixed | Still broken |
|---|---|---|
| Trust the operator | Nothing structural | Everything |
| Pooled with process | Ordinary disputes | Operator disappearing |
| Split keys | Operator disappearing with order funds | Balances parked outside orders |
That last row is the one to sit with. No escrow generation has ever protected money that was not attached to an active order, and no future one will, because the problem is not technical.
nexusb2l7fmqnefwphyy7m5zjhlkytlbo7qbb5lu5dlczr3azgii2gyd.onionnexusma2iegzo7atzwbrwxhcdopyri3vare2twibldnlc3txqjdeb5yd.onionnexusabcd6tyfhdwilyitaqiri6tisj2v2hueyjuj6qkvd6azvi5tuqd.onionOpen these in Tor Browser only. Before typing a password, compare the onion printed on the login screen against your address bar. If they do not match, close the tab.