Cross-Chain Atomic Swap

What Is a Cross-Chain Atomic Swap?

A cross-chain atomic swap is a peer-to-peer mechanism for exchanging cryptocurrencies across different blockchains without relying on a centralized exchange, custodian, or bridge. The word "atomic" means the trade is indivisible: both legs complete or neither does. You never end up in a state where one party has sent funds but the other has not.

The concept was first described by Tier Nolan on the Bitcointalk forum in May 2013, outlining the full HTLC-based protocol that every subsequent implementation follows. It remained theoretical for several years because most altcoins lacked the necessary scripting primitives. In September 2017, the Decred team executed the first widely recognized on-chain atomic swap between production blockchains (BTC and DCR), open-sourcing a reference implementation that also supported Litecoin and Vertcoin.

Unlike cross-chain bridges that pool funds in intermediary smart contracts (creating large honeypots), atomic swaps require no pooled capital and no trusted third party. Each participant retains self-custody of their assets until the moment the swap executes.

How It Works

Cross-chain atomic swaps use HTLCs on both blockchains, linked by a shared hash. The protocol unfolds in five steps. Suppose Alice holds BTC and Bob holds LTC, and they want to trade:

1. Alice generates a random secret (the preimage) and computes its hash. She shares only the hash with Bob.
2. Alice locks her BTC in an HTLC on the Bitcoin blockchain. The contract states: Bob can claim the BTC by providing the preimage before a 48-hour timelock expires. If unclaimed, Alice can refund her BTC after 48 hours.
3. Bob verifies Alice's HTLC on-chain, then creates his own HTLC on the Litecoin blockchain using the same hash. His contract states: Alice can claim the LTC by providing the preimage before a 24-hour timelock expires. If unclaimed, Bob can refund his LTC after 24 hours.
4. Alice claims Bob's LTC by submitting the preimage to Bob's HTLC on Litecoin. This claim transaction is published on-chain, making the preimage publicly visible.
5. Bob reads the preimage from Alice's claim transaction on Litecoin and uses it to claim Alice's BTC from the HTLC on Bitcoin.

If either party abandons the swap at any point, the timelocks ensure both parties can reclaim their original funds after the expiry period.

Timelock Ordering

The asymmetry in timelocks is critical. The initiator (Alice) must have a longer timelock than the responder (Bob): typically 48 hours versus 24 hours. This prevents a specific attack: if Alice's timelock were shorter or equal, she could wait for her refund to become available, reclaim her BTC, and then still use the preimage to claim Bob's LTC, effectively stealing from both sides.

The asymmetry ensures that Bob always has enough time to observe Alice's claim, extract the preimage, and submit his own claim transaction before Alice's refund window opens. For a deeper look at how timelocks work in Bitcoin, see the research on Bitcoin timelocks (CLTV and CSV).

On-Chain Script Example

A simplified Bitcoin Script for the HTLC that Alice creates on the Bitcoin side:

OP_IF
  OP_SHA256 <hash_of_preimage> OP_EQUALVERIFY
  <Bob's_pubkey> OP_CHECKSIG
OP_ELSE
  <48_hours> OP_CHECKLOCKTIMEVERIFY OP_DROP
  <Alice's_pubkey> OP_CHECKSIG
OP_ENDIF

The OP_IF branch lets Bob claim by providing the preimage and his signature. The OP_ELSE branch lets Alice reclaim after the timelock expires. Bob creates a mirror script on Litecoin with the same hash but a shorter timelock (24 hours) and swapped public keys.

Why It Matters

Cross-chain atomic swaps embody the core promise of cryptocurrency: trustless value transfer without intermediaries. They have practical implications across several areas:

• Decentralized trading: users can swap assets directly without depositing funds on a centralized exchange, eliminating counterparty risk from exchange hacks or insolvency
• Financial sovereignty: participants maintain full custody of their assets throughout the swap process, only relinquishing control at the moment of atomic settlement
• Privacy: no KYC or account creation is required, and no central entity records the trade (though on-chain transactions remain publicly visible)
• Bridge alternative: atomic swaps avoid the security risks of bridge contracts, which have suffered over $2 billion in exploits since 2022

Protocols like Spark and the Lightning Network build on the same HTLC primitives that power atomic swaps, enabling fast off-chain transfers that settle atomically without the on-chain wait times.

Submarine Swaps: The Lightning Variant

A submarine swap is an atomic swap between on-chain Bitcoin and the Lightning Network. It uses the same HTLC mechanism but bridges two different layers rather than two different blockchains.

In a normal submarine swap (on-chain to Lightning): a user sends BTC to an on-chain HTLC. The swap provider pays the user's Lightning invoice, which reveals the preimage needed to unlock the on-chain funds. The cryptographic linkage makes the exchange atomic. Reverse submarine swaps work in the opposite direction: Lightning to on-chain.

Services like Lightning Loop and Boltz Exchange use submarine swaps to let node operators manage channel liquidity without trusting a third party. For a detailed walkthrough, see the submarine swaps explainer.

Cross-Chain Atomic Swaps vs. Alternatives

Understanding how atomic swaps compare to other exchange mechanisms clarifies when each approach makes sense:

Use Cases

Decentralized Trading

Atomic swaps enable decentralized exchanges (DEXs) that operate across blockchains without wrapping assets or bridging tokens. Protocols like THORChain implement cross-chain atomic swaps supporting native asset swaps across Bitcoin, Ethereum, Solana, and other chains. Users trade real BTC for real ETH rather than synthetic or wrapped representations.

Privacy-Preserving Exchanges

For users who value financial privacy, atomic swaps offer a way to exchange assets without creating accounts or submitting identity documents. The Bitcoin-Monero atomic swap protocol (using adaptor signatures rather than HTLCs, since Monero lacks native HTLC support) has seen active daily use by privacy-focused communities since 2024.

Liquidity Management

Lightning Network node operators use atomic swap variants to manage channel balances. Loop In and Loop Out operations are submarine swaps that move funds between on-chain and Lightning without closing channels, enabling continuous operation of routing nodes.

Risks and Considerations

Free Option Problem

The most well-documented vulnerability in atomic swaps: the initiator effectively holds a free American Call Option during the swap window. After both parties lock their funds, the initiator can observe price movements and choose to complete the swap only if the price has moved in their favor. If the price moves against them, they simply let the timelock expire and reclaim their funds.

Research estimates the implicit value of this free option at 2 to 3 percent of the asset value for volatile cryptocurrency pairs. Proposed mitigations include requiring the initiator to post a premium or bond, and newer protocols like 4-Swap (2025) that are designed to be both grief-free and bribery-safe.

Griefing Attacks

Either party can abandon the swap after locking funds, forcing the counterparty to wait the full timelock duration before reclaiming their assets. This locks capital and imposes opportunity cost. The attacker pays only their own transaction fees.

Block Time Mismatch

Different chains have different block times and confirmation requirements. A swap between Bitcoin (10-minute blocks) and a chain with 12-second blocks means timelocks must be set conservatively to account for the slower chain. Network congestion can extend these windows further, leaving funds locked for extended periods.

Chain Compatibility

Both blockchains must support compatible scripting for HTLCs: specifically, hash locks and time locks using the same hash function. Not all chains meet this requirement. Monero, for example, lacks native HTLC support and requires specialized adaptor signature protocols for atomic swaps.

Privacy and Linkability

On-chain atomic swaps create visible transactions on both blockchains. An observer can correlate the two sides by matching hash values, timelock patterns, and timing, potentially linking a user's identities across chains. Research into scriptless scripts and adaptor signatures aims to mitigate this by removing the shared hash from on-chain data.

For a broader comparison of cross-chain security models, see the research on cross-chain bridging risks.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.