How it works
RoboSats is a Lightning-Network peer-to-peer exchange reachable over Tor (and I2P) at an .onion address that has been stable since 2022. There is no signup. The first thing the client does is generate a single-use Robot avatar — a deterministic identity built from a random token — which becomes the user's pseudonym for one trade. Order matching, chat, and dispute handling run on federated coordinators. Each coordinator publishes its order book; the unified client app stitches them into one. Coordinators never custody bitcoin in a wallet of their own. They hold Lightning hold invoices: the maker locks a bond, the taker locks a bond and the trade amount, the fiat leg settles peer-to-peer (SEPA, Revolut, in-person cash, gift cards, dozens of methods), and the coordinator releases or refunds the hold invoices once both sides confirm. If a peer cheats, their bond is forfeited.
KYC & privacy
There is no KYC, anywhere in the funnel. No email, no phone, no username. The terms state KYC will not be requested. The default client is the .onion build, which means the coordinator never sees an IP. The Robot avatar is regenerated per trade; previous trades are not linkable to the next without the user voluntarily reusing the token. The privacy story has two real caveats. First, the fiat leg leaks: a Revolut, SEPA or bank transfer is as identifying here as it is on Bisq or Hodl Hodl, and reports of Revolut accounts frozen after a string of RoboSats sells in 24 hours are not unusual. Second, a malicious coordinator could log chat metadata, which is why the federation matters: the client lets the user pick an alternative.
Strengths and limits
The project is unusually clean for a four-year-old open-source exchange. The codebase is AGPL-3.0, development is led by the pseudonymous Reckless_Satoshi, and the federation model has shifted the project from one backend to multiple independent operators with a maturing reputation system and progressive order-size limits for new coordinators. Lightning hold invoices are a useful escrow primitive: they remove the custodial wallet that has historically been the failure point on every other no-KYC venue. The limits are honest and documented. RoboSats has never been independently audited. The Lightning Network and the backend are not, in the project's own words, hack-proof. Hold-invoice flows can stall if a peer goes offline mid-trade, which is why the platform is positioned for smaller sizes — large positions still belong on Bisq or Haveno, both of which run on-chain multisig. Coordinator availability is uneven; some have come and gone since the federation launched. There is no official iOS App Store build; the Android client is sideload-only.
Verdict
RoboSats has the cleanest privacy posture of any production Lightning-Network exchange in 2026, and the federation model now distributes the risk that used to sit with a single backend. It is not yet at the audited, decade-deep level of Bisq, and the latest tag is still labelled alpha. The fit is clear: small-to-medium Lightning swaps where the priority is privacy, not size. Grade: A- (8.8/10). Trust: TRUSTED.
RoboSats has the cleanest privacy posture of any production Lightning-Network exchange in 2026, and the federation model now distributes the risk that used to sit with a single backend. It is not yet at the audited, decade-deep level of Bisq, and the latest tag is still labelled alpha. Grade: A- (8.8/10). Trust: TRUSTED.
