RoboSats

Tor-native P2P Lightning exchange with zero account requirement.

robosats.org

Zero KYC
Evidence and facts →

Tor-native P2P Lightning exchange with zero account requirement.

Common useBTC/fiat P2P tradingP2P / LightningOperator dataUnknown

Identity checksZero KYCNo document check recorded · identity exposure level 0/4

Evidence and riskPartial evidenceCautionSome material claims still need confirmation.; those sources show trade-offs worth reading.

Last reviewedReviewed 5 Sep 2026KYC checked 5 Sep 2026 · unknown jurisdiction · Source → official documentationHow to cite this pageSource coveragePartial evidenceRecorded riskCaution

Evidence and facts

CUNICULA SCORE 4.0

49/100Limited evidencePrivacy 17/25 · Control 12/20 · Transparency 12/20 · Security 13/25 · Accountability 2/10 · Cap 49 · Method

JURISDICTIONUnknown

INCIDENTPython CI workflow allowed pull-request code execution
resolved · high · since 2026-08-20
GHSA-rxx8-rv5g-wpch describes a high-severity pull_request_target workflow flaw through 0.8.5-alpha. RoboSats identifies 0.8.6-alpha as patched and that release was already current when the advisory was published. RoboSats GHSA-rxx8-rv5g-wpch, Current latest RoboSats release

INCIDENTJavaScript CI workflow allowed pull-request code execution
resolved · high · since 2026-08-20
GHSA-xjwx-6j4q-hrr6 describes high-severity arbitrary runner-code execution through 0.8.5. RoboSats identifies 0.8.6 as patched and that release was already current when the advisory was published. RoboSats GHSA-xjwx-6j4q-hrr6, Current latest RoboSats release

INCIDENTCoordinator notice raw HTML permits JavaScript execution
monitoring · medium · since 2026-08-20
RoboSats published GHSA-p353-f8m7-8v95: coordinator notice HTML can execute JavaScript and expose robot root credentials across coordinators. Versions through 0.8.6-alpha are affected; 0.8.7-alpha is the patched line, while the current latest release is 0.8.6-alpha. RoboSats GHSA-p353-f8m7-8v95, Current latest RoboSats release

INCIDENTPrivate orders exposed through unauthenticated API filters
monitoring · medium · since 2026-08-20
RoboSats published GHSA-r6f6-x59j-8q69: password-protected orders can be returned without authentication, including payment method, amount, maker nickname and face-to-face coordinates. Versions through 0.8.6-alpha are affected; 0.8.7-alpha is the patched line, while the current latest release is 0.8.6-alpha. RoboSats GHSA-r6f6-x59j-8q69, Current latest RoboSats release

INCIDENTConcurrent reward withdrawals could drain coordinator funds
resolved · medium · since 2026-08-20
GHSA-vp6p-w2r2-jj2v describes a reward-withdrawal race condition affecting versions through 0.8.5-alpha. RoboSats identifies 0.8.6-alpha as patched and that release was already current when the advisory was published. RoboSats GHSA-vp6p-w2r2-jj2v, Current latest RoboSats release

AUDITED BYNo audit listed

OPERATOR DATAUnknown

SOURCE COVERAGE

Partial evidenceTHIRD-PARTY REPORTED10/10Reviewed 5 Sep 2026 · Source → official documentation

LAST CHECKED2026-06-22

LAST UPDATED2026-09-05

Specs

DOCUMENT CHECKNone recorded

IDENTITY EXPOSURELevel 0/4

KYC TRIGGERSNo account/KYC model found in official repository; robot identities are generated per use and Lightning hold invoices handle bonds/escrow.

FEE0.2% total: 0.025% maker and 0.175% taker; Lightning routing and on-chain payout fees can be additional

LIMITCoordinator-specific

CATEGORIESP2P / Lightning

COMMON USESBTC/fiat P2P trading, High privacy users, Tor-only workflows

FEATURESTor, LN escrow, Quick trades

TORYes

REGIONSGlobal availability

Review analysis, source material, related services, and history

About

Open-source P2P Bitcoin exchange using Lightning hold invoices, robot avatars and Tor-first access.

Analysis

OVERVIEW

Per-session robot identities, Lightning hold invoices for bonds and escrow, and Tor-first access: the venue is built so that nothing persistent identifies a trader across trades.

LIMITS

The record notes clearnet endpoints were unreachable during review and coordinator availability varies; amounts are Lightning-scaled, and the fiat leg remains a counterparty exposure.

USEFUL FOR

Quick Bitcoin-fiat swaps over Tor at Lightning-sized amounts.

Sources · reviewed 2026-07-16

RoboSats documentation ↗

Frequently Asked Questions

Is identity verification required?

No identity verification is recorded for typical use. No account/KYC model found in official repository; robot identities are generated per use and Lightning hold invoices handle bonds/escrow.

Which payment methods are accepted?

Please check the provider site for accepted payment methods.

Where is it available?

Recorded availability: GLOBAL.

Is the operator based in a Five Eyes country?

The jurisdiction is not publicly confirmed. Check the provider site for incorporation details.

How are identity, operator, and evidence fields reported?

Identity exposure is level 0 of 4. Hosted operator data has not been established. Jurisdiction is shown as context, not a safety verdict. Source coverage is partial evidence, last reviewed 2026-09-05, and recorded risk is caution.

Related Services

BitcoinVoucherBotbitcoinvoucher.botbitcoinvoucher.bot · P2P · ??

P2P Bitcoin trades with Lightning funding and Liquid escrow.

Cunicula scoreNot ratedSource coveragePartial Zero KYC

About Visit ↗

Sources and history

Service history

Latest meaningful changes to the facts shown on this provider page.

5 Sep 2026
Review overdue providers against current sources
Fee, KYC last checked, Last reviewed, Limit, and 3 more
27 Aug 2026
Reconcile score 4.0 evidence
Audited by, Evidence status, Score assessment / Control model, Score assessment / Operator data exposure, and 1 more
26 Aug 2026
Apply full-service rereview and score 4.0
Privacy warning, Recorded risk, Score assessment

Full service history

5 Sep 2026updated
Review overdue providers against current sources
Fee
0.2%0.2% total: 0.025% maker and 0.175% taker; Lightning routing and on-chain payout fees can be additional
KYC last checked
2026-06-222026-09-05
Last reviewed
2026-06-222026-09-05
Limit
not setCoordinator-specific
Privacy warning
Tor-only access reduces network exposure but does not remove coordinator trust. In versions through 0.8.6, a coordinator can run JavaScript through raw-HTML notices and password-protected public orders can be read without authentication, including payment method, amount, maker nick and F2F latitude/longitude. Wait for or verify upgrade to 0.8.7+.RoboSats is no-KYC and normally used over Tor, but users still trust the selected coordinator for availability, dispute handling and its configured trade limit. Versions through 0.8.6 had a raw HTML execution issue and a private-order data leak. Both are patched in v0.8.7-alpha, released September 4, 2026. Update before trading and verify the coordinator and client version.
Source reviewed
official sitehttps://github.com/RoboSats/robosats/releases/tag/v0.8.7-alpha
Updated at
2026-06-222026-09-05
Review source: official documentation · public history entry
27 Aug 2026updated
Reconcile score 4.0 evidence
Audited by
not setnone
Evidence status
verifiedpartial
Score assessment / Control model
decentralizedfederated
Score assessment / Operator data exposure
limitedmoderate
Score review
not setOutcome: HOLD; Checked at: 2026-08-27; Inputs: Operator data exposure: moderate; Control model: federated; Source model: open; Audit: Score eligible: no; Reason: No dated, scoped independent audit of the score-critical core was evidenced; no audit points are granted.
Review source: official site · public history entry
26 Aug 2026updated
Apply full-service rereview and score 4.0
Privacy warning
Clearnet service URLs were unreachable from the VPS during review; official GitHub and indexed sources remain live. Use Tor/onion where available and verify current coordinator availability.Tor-only access reduces network exposure but does not remove coordinator trust. In versions through 0.8.6, a coordinator can run JavaScript through raw-HTML notices and password-protected public orders can be read without authentication, including payment method, amount, maker nick and F2F latitude/longitude. Wait for or verify upgrade to 0.8.7+.
Recorded risk
standardcaution
Score assessment
not setOperator data exposure: limited; Control model: decentralized; Source model: open
Review source: official site · public history entry
9 Aug 2026updated
Corporate registry information updated
Corporate / Entity type
not setunresolved
Review source: official site · public history entry
8 Aug 2026updated
Corporate registry information updated
Corporate
not setOfficers: none; Prior entities: none
Review source: official site · public history entry
8 Aug 2026updated
Provider summary rewritten
Description
Open-source P2P Bitcoin exchange using Lightning hold invoices, deterministic robot avatars and Tor-first access to minimize custody and identity exposure.Open-source P2P Bitcoin exchange using Lightning hold invoices, robot avatars and Tor-first access.
Review source: official site · public history entry
7 Aug 2026updated
Provider summary rewritten
Card summary
not setTor-first P2P bitcoin swaps over Lightning.
Review source: official site · public history entry
6 Aug 2026updated
Provider presentation updated
Evidence status
not setverified
Recorded risk
not setstandard
Trust level
verifiednot set
Review source: official site · public history entry
23 Jun 2026updated
Provider facts reviewed and updated
Checked at
2025-08-302026-06-22
Description
RoboSats — Tor-native, Lightning-based P2P Bitcoin exchange. Fully anonymous robot identities, no accounts, native onion service.Open-source P2P Bitcoin exchange using Lightning hold invoices, deterministic robot avatars and Tor-first access to minimize custody and identity exposure.
Domain
robosats.comrobosats.org
Jurisdiction
not set??
KYC requirement
lightnone
KYC last checked
2025-08-302026-06-22
Kyc note
Tor-only. Generates new robot identity per trade. No persistent account.No account/KYC model found in official repository; robot identities are generated per use and Lightning hold invoices handle bonds/escrow.
Last reviewed
2025-08-302026-06-22
Privacy warning
not setClearnet service URLs were unreachable from the VPS during review; official GitHub and indexed sources remain live. Use Tor/onion where available and verify current coordinator availability.
Source reviewed
older source, not independently verifiedofficial site
Status
okwarning
Updated at
2026-03-122026-06-22
Url
https://robosats.com/https://robosats.org/
Review source: official site · public history entry
22 Jun 2026updated
Ship trust audit remediation pass
Jurisdiction confidence
not setunknown
KYC last checked
not set2025-08-30
Last reviewed
not set2025-08-30
Source reviewed
not setolder source, not independently verified
Review source: older source, not independently verified · public history entry
7 Apr 2026updated
Drop warrantCanary trust signal
Warrant canary
nonot set
Review source: source not recorded · public history entry
29 Mar 2026updated
KYC risk level system + advanced directory filters
KYC level
zero0
Review source: source not recorded · public history entry
15 Mar 2026updated
SEO hardening, OG images, ErrorBoundary, Zod validation, CSS article extraction
Countries
noneGLOBAL
Review source: source not recorded · public history entry
14 Mar 2026updated
Offline status bug, vetted grid, news/projects img tags
Status
liveok
Review source: source not recorded · public history entry
14 Mar 2026updated
Provider presentation updated
Best for
General usageBTC/fiat P2P trading, High privacy users, Tor-only workflows
Fee
not set0.2%
Kyc note
Expect unexpected KYC triggers for withdrawals above arbitrary risk thresholds.Tor-only. Generates new robot identity per trade. No persistent account.
Privacy warning
not setnot set
Tagline
A custodial or semi-custodial financial service.Tor-native P2P Lightning exchange with zero account requirement.
Trending
not setno
Twitter
not sethttps://x.com/RoboSats
Updated at
not set2026-03-12
Votes
295not set
Review source: source not recorded · public history entry
11 Mar 2026updated
Provider summary rewritten
Description
Peer-to-peer bitcoin trading with fast processing. (Light KYC)RoboSats — Tor-native, Lightning-based P2P Bitcoin exchange. Fully anonymous robot identities, no accounts, native onion service.
Review source: source not recorded · public history entry
10 Mar 2026updated
Provider facts reviewed and updated
Best for
not setGeneral usage
Kyc note
not setExpect unexpected KYC triggers for withdrawals above arbitrary risk thresholds.
Tagline
not setA custodial or semi-custodial financial service.
Review source: source not recorded · public history entry
8 Mar 2026updated
Social links re-verified
Telegram
https://t.me/robosatsnot set
Twitter
https://x.com/robosatsnot set
Review source: source not recorded · public history entry
8 Mar 2026updated
Social links re-verified
Telegram
not sethttps://t.me/robosats
Twitter
not sethttps://x.com/robosats
Review source: source not recorded · public history entry
8 Mar 2026updated
Social links re-verified
Telegram
https://t.me/robosatsnot set
Twitter
https://x.com/robosatsnot set
Review source: source not recorded · public history entry
8 Mar 2026updated
Social links re-verified
Telegram
not sethttps://t.me/robosats
Twitter
not sethttps://x.com/robosats
Review source: source not recorded · public history entry
8 Mar 2026updated
Trust fields for all 77 services + provider page trust display
Audited by
not setnot set
Jurisdiction
not setnot set
Trust level
not setverified
Warrant canary
not setno
Review source: source not recorded · public history entry
22 Sep 2025updated
Describe the change
Description
RoboSats — robosats.comPeer-to-peer bitcoin trading with fast processing. (Light KYC)
Review source: source not recorded · public history entry
2 Sep 2025created
Init
Provider profile
not setcreated
Review source: source not recorded · public history entry

Only fields shown on the provider page are tracked. Private identifiers are never published.

Evidence basis: Claims on this page are linked to published sources for comparison, not certification, audit, endorsement, or recommendation; read the methodology and coverage map before relying on an entry.