Peer-to-peer atomic swap between Bitcoin (signet) and Alephium (testnet) using MuSig2 adaptor signatures. No intermediaries, no custodians.
Roles
Alice = ALPH seller, Bob = BTC seller. If you publish a "Sell ALPH" offer or accept a "Buy ALPH" offer, you are Alice. Otherwise you are Bob.
Protocol Simulator
Click Start, then fire transitions to explore happy path, cancel, and abort scenarios.
Protocol (5 steps)
- Setup — Alice generates an adaptor secret t and sends the public adaptor point T to Bob. Both know each other's Bitcoin and Alephium keys from the offer and the accept.
- Lock — Bob locks BTC in a Taproot output whose refund leaf opens at Tbtc = now + 24 h (absolute locktime). Alice waits for the lock to confirm, then deploys the ALPH contract with timeout Talph = Tbtc + 12 h. Bob checks the deployment's depth, its state and that Talph is at least 6 h after Tbtc before he signs anything.
- Nonces — Commit-then-reveal MuSig2 nonce exchange (BIP327; a secret nonce is used once)
- Pre-sign — Exchange adaptor pre-signatures for the BTC claim and the ALPH claim; each side verifies the other's
- Claim — Alice completes the adaptor signature and claims BTC, revealing t in the Bitcoin witness (her page bumps the fee if the claim stalls). Once that claim is confirmed, Bob extracts t and claims the ALPH.
Timeouts & Refunds
| BTC refund (Tbtc) | 24 h after Bob's lock, absolute locktime measured against Bitcoin's median time past. Bob's page refunds automatically as soon as it opens. |
| ALPH refund (Talph) | Tbtc + 12 h. refund() can then be called by anyone and always pays Alice. |
| Offer expiry | 24 h after publishing |
| Message waits | Up to 6 h for the peer's next message during the lock and claim phases (a signet block can take 20 min), 1 h otherwise |
Talph > Tbtc is what makes the swap atomic: Alice's claim reveals t, so her ALPH refund must open only after Bob's BTC refund, otherwise she could refund her ALPH and then still take the BTC. Bob refuses to sign for a contract that violates this. The remaining requirement is on Bob: he must claim the ALPH within the 12 h after Alice's claim, which his page does as soon as her claim is confirmed.
Security
- Funds are safe at every step — if the peer disappears, the recovery panel shows the refund countdown and refunds when it opens
- Swap messages (setup, nonces, pre-signatures, claims) are NIP-44 encrypted peer-to-peer; offers are public so anyone on Nostr can find them
- One secret, standard keys: 12 BIP39 words (24 for identities created before 2026-10-01, where the nsec is the secret itself); the Nostr key (NIP-06), the Bitcoin key (BIP86 taproot) and the Alephium account (wallet path, group 1) derive from them and can be imported into Sparrow, Bitcoin Core or the Alephium wallet; no signature is valid on two chains
- Every transaction built by a node is decoded and checked before it is signed; the contract is shipped pre-compiled and its bytecode is verified on chain
- BTC side uses Taproot MuSig2 (BIP327). ALPH side uses a Ralph contract — asymmetric by design for inspectable state, unilateral locking, and explicit timeouts
- Your key is stored unencrypted in this browser: use a profile only you have access to, keep the amounts small, and back up your recovery words
- Install the page (browser menu) and turn on Notifications to be told when the peer acts or a wait ends while the tab is in the background
- Settings lets you point the page at your own Esplora, Alephium node and relays, or switch networks; mainnet needs a typed confirmation, shows a red banner and asks again before every offer, and has had no dry run yet
Important Notes
- Bob (BTC seller) needs a little ALPH (~0.01 ALPH) to pay gas when claiming ALPH. Use the ALPH faucet before accepting a swap.
- Both pages must run the same build (the log shows it) and show the same session id once a swap starts.
- A swap takes two signet blocks at least (Bob's lock, Alice's claim): plan for 30 to 60 minutes.
Recovery
Swap state is saved in this browser at every checkpoint (started, btc_locked, locked, presigned, btc_claimed). If the page is reloaded mid-swap, the recovery panel offers to resume (peer online), claim, or refund once the timeout opens; the setup, lock and deployment steps can be retried without locking or deploying twice.