--- title: "What Is an Atomic Swap? How Cross-Chain HTLC Swaps Work" url: "https://bip39-phrase.com/atomic-swap/" language: "en" published: "2025-11-09T00:00:00+00:00" updated: "2026-10-19T00:00:00+00:00" --- [ Markets ](/topics/markets/) Published November 9, 2025 Updated October 19, 2026 # What Is an Atomic Swap? How Cross-Chain HTLC Swaps Work ![What Is an Atomic Swap? How Cross-Chain HTLC Swaps Work](/wp-content/uploads/2025/11/Atomic-Swap-hero.webp) An atomic swap is a trade of two cryptocurrencies on different blockchains, settled directly between the two parties’ wallets, in which either both transfers happen or neither does. No exchange or custodian holds the coins in between: each side locks its coins in a contract on its own chain that pays the other party only if they reveal a secret before a deadline, and lets the owner take the coins back after it. Tier Nolan described the scheme on the Bitcointalk forum in May 2013 ([Alt chains and atomic transfers](https://bitcointalk.org/index.php?topic=193281.0)). Below: a swap step by step, the hashed timelock contracts behind it, which coins support it, and its costs and risks. ## Atomic Swaps at a Glance | Topic | Summary | | ------------------ | --------------------------------------------------------------------------------------------------- | | **What it is** | A direct, all-or-nothing trade of coins that live on two different blockchains | | **Mechanism** | Hashed timelock contracts (HTLCs): a hash lock and a time lock on each chain | | **Requirements** | Both chains must support the same hash function and time locks, natively or through smart contracts | | **Custody** | Each party keeps its own keys; no third party can take the coins | | **Costs** | Network fees on both chains, usually two transactions per side; no exchange fees | | **Main drawbacks** | Slow, few easy wallets, both sides must stay online, the initiator gets a free option | ## How Does an Atomic Swap Work, Step by Step? Say Alice has bitcoin, Bob has litecoin, and they have agreed on amounts. Alice starts the swap: | Step | Alice (has BTC) | Bob (has LTC) | | ---- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | | 1 | Picks a random secret and sends Bob only its SHA-256 hash | Waits | | 2 | Locks her BTC in a contract: Bob can claim it with the secret; after 48 hours Alice can take it back | Checks Alice’s contract on the Bitcoin blockchain | | 3 | Checks Bob’s contract on the Litecoin blockchain | Locks his LTC under the same hash: Alice can claim it with the secret; after 24 hours Bob can take it back | | 4 | Claims the LTC, which publishes the secret on the Litecoin blockchain | Watches the Litecoin blockchain | | 5 | Done | Copies the secret from Alice’s claim and claims the BTC | The trade is atomic because the only way for Alice to collect Bob’s coins is to reveal the secret that also unlocks hers for Bob. If Bob never locks his litecoin, Alice waits out her 48 hours and takes her bitcoin back. If Alice never claims, both time locks expire and each side recovers its own coins. The deadlines are not symmetric for a reason. Alice’s lock must run longer than Bob’s: if both expired together, Alice could claim Bob’s coins at the last moment and refund her own before Bob had time to use the secret. With 48 against 24 hours, Bob still has at least a day after Alice reveals it. Refunds are not automatic, either: after a time lock expires, the owner has to broadcast a refund transaction, so swap software must keep running or be reopened in time. ## What Is a Hashed Timelock Contract (HTLC)? An HTLC is a script with two ways to spend the locked coins. The hash lock pays the recipient if they present the preimage of a given hash, that is, the secret; the time lock pays the original owner back once a set time or number of blocks has passed. [BIP-199](https://github.com/bitcoin/bips/blob/master/bip-0199.mediawiki), by Sean Bowe and Daira Hopwood, specifies the Bitcoin version: ```text OP_IF [HASHOP] OP_EQUALVERIFY OP_DUP OP_HASH160 OP_ELSE [TIMEOUTOP] OP_DROP OP_DUP OP_HASH160 OP_ENDIF OP_EQUALVERIFY OP_CHECKSIG ``` `[HASHOP]` is OP\_SHA256 or OP\_HASH160, and `[TIMEOUTOP]` is OP\_CHECKSEQUENCEVERIFY or OP\_CHECKLOCKTIMEVERIFY. The BIP spells out the same tension as the deadlines above: the party funding the contract wants a short timeout so that its money isn’t tied up for long, while the party who will reveal the secret wants a long one, so that its claim confirms before the refund becomes possible. On Ethereum and other EVM networks, the same two conditions are written as a [smart contract](/smart-contract-evm-what-it-is-and-how-it-works/) instead of a script. ## Which Coins Support Atomic Swaps? Both blockchains need a scripting system that can check a hash preimage and enforce a time lock, and both contracts must use the same hash function. Bitcoin, Litecoin, Bitcoin Cash and Decred meet these conditions, and so does any EVM chain through a contract. An early public demonstration was a swap between Decred and Litecoin on September 19, 2017, made with Decred’s open-source swap tools ([Decred blog](https://blog.decred.org/2017/09/20/On-Chain-Atomic-Swaps/)). Coins without such scripts need other cryptographic constructions, which is why swaps involving them remain rare. ## What Do You Gain Over an Exchange Trade? - **No custodian.** The coins never sit in an exchange’s wallet, so the trade doesn’t depend on an exchange’s security or solvency ([exchange vs wallet](/crypto-exchange-wallet-difference/) explains that risk). - **Low transaction costs.** There are no exchange trading or withdrawal fees, only the network fees on each chain: each side usually pays for one transaction that locks its coins and one that claims the other side’s coins, or takes a refund if the swap fails. - **Rules enforced by the network.** The scripts are checked by every node, so neither party can change the terms once the coins are locked. - **Transparency.** Each step is recorded on-chain and can be verified by both parties. - **Cross-chain trading.** Coins move between independent blockchains without wrapped tokens or a bridge operator. ## What Are the Risks and Limitations? - **The free option problem.** Once Bob has locked his coins, Alice can wait and complete the swap only if the price has moved in her favor. Runchao Han, Haoyu Lin and Jiangshan Yu showed that an atomic swap is equivalent to an American call option without the premium, and estimated that missing premium at 2–3% of the asset value for cryptocurrencies ([On the optionality and fairness of Atomic Swaps](https://eprint.iacr.org/2019/896), AFT ‘19). - **Time and confirmations.** Each lock needs enough confirmations before the other side can safely act, because a chain reorganization can undo a recent transaction ([how the longest-chain rule settles forks](/longest-chain-in-blockchain-explained-security-consensus-forks/)). A fee spike can delay a claim or refund near its deadline, so swap software must pay enough to get through a busy [mempool](/bitcoin-mempool/). - **Staying online.** Each party must claim or refund in time; a wallet that is offline when it matters can lose the race. - **Finding a counterparty.** A swap needs someone holding the other coin who agrees on the price, which is why swap protocols add order books or market makers on top. - **Privacy.** The same hash appears in both contracts, so anyone who watches both chains can link the two halves of the trade. - **Software bugs.** Contract or wallet mistakes can lock funds or expose them, so use well-tested software and try small amounts first. ## Atomic Swap vs Exchange vs P2P Marketplace | | Atomic swap | Centralized exchange | P2P marketplace | | ---------------------------------------- | ------------------------------------ | --------------------------------------------- | --------------------------------------- | | **Who holds the coins during the trade** | Nobody: they are locked in contracts | The exchange | The platform’s escrow | | **Main risk** | Timing and software errors | Exchange hacks, insolvency or frozen accounts | Payment fraud and disputes | | **Speed** | Confirmations on two blockchains | Instant matching | As fast as the fiat payment | | **Fiat currency** | No, crypto for crypto only | Yes | Yes | | **Identity checks** | None in the protocol itself | Usually required | Usually required on regulated platforms | That sets atomic swaps apart from [P2P trading platforms](/p2p-crypto-trading/), where the platform holds the seller’s coins in escrow until the buyer’s payment arrives. The protocol performs no identity checks, but the exchanges and services where traders buy and sell the coins still apply [anti-money-laundering rules](/anti-money-laundering-crypto/). ## Where Are HTLC Swaps Used Today? The largest use of the idea is not on exchanges at all but inside the Lightning Network: BIP-199 notes that Lightning uses HTLC scripts to perform atomic swaps between payment channels, so a payment can hop through several nodes and either arrive in full or not at all. Swaps between Lightning and on-chain bitcoin, known as submarine swaps, rely on the same hash lock ([Bitcoin Optech](https://bitcoinops.org/en/topics/submarine-swaps/)). Cross-chain swaps between different coins exist as well, mostly through specialized wallets and swap protocols, and remain a niche next to centralized exchanges. More trading topics are collected in our [crypto markets guides](/topics/markets/). ## Frequently Asked Questions ### Are atomic swaps safe? The protocol removes the need to trust the other party with your coins: if they don’t follow through, you can take your coins back after the time lock expires. The remaining risks are practical ones, such as software bugs, missing a deadline or fees that delay a claim. ### What happens if the other side never locks their coins? Nothing is lost except time and network fees. The initiator waits until their own time lock expires and broadcasts a refund transaction. ### Is an atomic swap the same as a cross-chain bridge? No. A bridge usually locks coins on one chain and issues a wrapped token on another, with a contract or operator holding the originals. An atomic swap exchanges native coins between two owners and leaves nothing locked once it completes. [ Back to Blog ](/blog/)