Swapping BTC to XMR over Tor

The onion address

This site has a Tor mirror at btcxmrj6vte7yjuefnju3nowry5o76po6mtsnnk5jkoj3jmyp2mt2oqd.onion. It is the same webapp, on the same server, talking to the same maker, so the quote, the minimum and maximum and the swap itself are identical to the swap form at btc-xmr.com. Open it in Tor Browser and you get the same form; the mechanics of the swap are explained on the /how page.

The maker on the other side of the swap, the program that holds the XMR and locks it against your BTC, is itself published as a Tor hidden service. The webapp runs a taker on our server; on the onion mirror that taker is set to reach the maker over Tor and the clearnet/Tor switch shown on btc-xmr.com is not offered, because there is nothing to choose.

The clearnet address takes a different path. btc-xmr.com is served through a CDN in front of a reverse proxy on our machine, so on that path the CDN terminates your TLS connection and sees your IP address before our server does. The onion path skips the CDN.

Onion addresses are 56 characters and there is no short form. Bookmark it from this page and compare every character; a lookalike address can be generated by anyone and would not lead to us.

What Tor hides here and what it does not

Tor hides your IP address from us and from any intermediary, and it hides from your network operator that you opened a swap site. That is what it is for, and on the onion mirror it does that job.

It does not change what a swap needs. To run a swap, the server must see the BTC amount, the Bitcoin transaction that funds the lock, and the Monero address you want the XMR sent to. Those are visible to us while the swap runs and for as long as the maker needs them to finish or refund it. There is no account, no profile, no email and no name attached to any of that. The /privacy page lists what is collected.

It does not hide the chains either. The Bitcoin side of an atomic swap is a normal public transaction: the coins you send go into a 2-of-2 lock and stay on the Bitcoin ledger forever, with the amount and the input address. Anyone who can already tie that input to you can see that you locked BTC in a swap. Tor does nothing about that; only how you obtained and handled those coins does. On the Monero side, the XMR arrives in a standard Monero transaction, whose amount, sender and receiver are hidden on-chain, but the maker knows the address it paid. "No KYC, no account" is a statement about what we ask of you, not a promise that the swap is invisible to chain analysis.

One more thing the onion mirror does not remove: the page loads a Google Analytics tag, the one named on /privacy. Over the onion that request goes out through Tor like everything else, but it is a request to a third party, and Tor Browser does not block it on its own. If you do not want it, a content blocker or the desktop app below avoids it.

JavaScript and browser wallets

The webapp needs JavaScript, and it needs a Bitcoin browser wallet, such as Unisat, to sign the transaction that funds the swap. Both are real limits for Tor users. Tor Browser on the "Safest" security level disables JavaScript for every site, onion or not, so the swap form will not load there. On "Standard" it runs; "Safer" keeps JavaScript on for sites the browser treats as secure, which the onion mirror and the HTTPS clearnet site should both be.

The wallet adds its own caveats. A wallet extension makes its own network calls to fetch balances and unspent outputs and to broadcast the signed transaction, and it makes them to its own servers, which then see your Bitcoin addresses. Whether those calls go through Tor depends on the browser the extension is installed in and on how it is built; we have not audited any wallet. The wallets we list are distributed through the Chrome Web Store, and Tor Browser is built on Firefox, so check with the wallet whether a build exists for it at all. Installing any extension in Tor Browser also changes your browser fingerprint, which is why the Tor Project advises against it.

If you want the full Tor Browser protections, or you do not want a browser wallet involved at all, do not fight the webapp. Use the desktop app.

The desktop-app alternative

The eigenwallet desktop app runs the taker on your own machine, with its own Bitcoin and Monero wallets, so there is no JavaScript in a browser, no extension and no analytics tag. To reach this maker from it, add our rendezvous node: /dns4/p2p.btc-xmr.com/tcp/8890/p2p/12D3KooWBPe3sx6dDqE1RSzeBpH1ayghtBp4cgyymti5rPy79xWz. The app then shows the same maker with its live quote, the one you see on the swap page at /. The /desktop-app page walks through it.

The trade-off is time and attention. The app has to sync its wallets before you can start, and it has to stay online while the swap runs, typically 30 to 60 minutes for one Bitcoin confirmation and ten Monero confirmations. If the maker fails, the refund is not something you collect whenever you like: the taker software must be online after the cancel timelock opens and before the punish timelock closes to publish the refund (on this site that taker runs on our server; with the desktop app it is your computer), and the /how page gives the current block counts. In exchange, you hold the keys on both sides and you choose how the app reaches the network.