Hodl Hodl: Bitcoin escrow, direct payments and P2P lending

Hodl Hodl matches people buying and selling Bitcoin while they arrange payment directly. A buyer needs an external receiving wallet; there is no ordinary exchange cash balance to fund first. Its published reach counters report more than 300,000 registered users and 100,000 completed deals, without a dated active-trader or current-volume measure.[1]

The July beginner guide describes fixed prices or a selected exchange rate with a premium or discount. Offer creators choose a fixed amount or range, up to ten payment methods, working hours and public or private visibility. An offer’s payment window is a settlement deadline, not a promise that a bank or counterparty will finish within it.[6]

A first-trade limit caps the initial transaction with a new counterparty. This is separate from the account’s overall limit level. The security guide also advises keeping negotiations in the contract chat, since that is the conversation support can assess during a dispute.[8]

The about page’s “split” description does not specify each side’s charge.[1]

The detailed guide assigns a separate rate to each party. For a hypothetical 0.1 BTC contract at the standard rate on both sides, the seller funds 0.10075 BTC and the buyer receives 0.09925 BTC before network charges. Total platform fees are 0.0015 BTC; the fiat payment is separate.[3]

The referral overview describes Bitcoin rewards paid to the wallet saved in settings; the dashboard shows invited users, activity and earnings. These are fee-sharing payments, separate from the permanent dealing discount.[19]

Reward tiers: 5% below 50 active referrals, 8% at 50–99, 10% at 100+. Active means nonsuspended with a completed trade within three months. Fee-bearing trades only; 546-sat minimum; missing payout address before completion forfeits payment. Dual-referral trades cap at 10%. Disqualification or termination ends future rewards without notice.[2]

If the buyer has not marked payment sent, the seller can cancel and recover escrow after the payment window expires. This is different from a Paid contract, which needs the dispute route if payment is contested.[5]

A payment receipt or a Paid status is not proof that the seller has received cleared money. The security guide specifically identifies reversible methods such as PayPal as a separate risk. Marking payment sent prevents ordinary cancellation; failing to mark it can leave the contract cancellable when its window expires.[8]

Lightning sellers fund using the displayed invoice or QR code. Buyers can supply a Lightning address, LNURL or invoice for receipt; an expired invoice must be replaced. The step-by-step guide requires the payment password and a 2FA code to establish escrow. The external fiat transfer still waits for confirmed escrow funding, even though Bitcoin uses a faster network route.[7]

Counterparties can co-sign on-chain without Hodl Hodl using prepared encrypted keys and custom transactions; assisted recovery is unavailable.[4]

On-chain escrow uses two of three keys. The platform cannot release Bitcoin alone, but its participation in a disputed release remains consequential. “Non-custodial” therefore describes the signing arrangement; it does not mean that the fiat payment, browser access or disagreement with the other trader has disappeared.[1]

Lightning uses Arkade vTXOs and three-of-four signing: buyer, seller, Hodl Hodl and Arkade. Failed payouts await replacement destinations in escrow.[4]

The account password controls login; the payment password encrypts the escrow key. The trading guide asks users to create the latter before their first contract. Recovering a website login is consequently a different task from regaining the ability to sign an escrow transaction.[6]

Security guide: 2FA mandatory; terms: optional.[8][2]

The contact page says support cannot reset 2FA. Each of the six saved backup codes is usable once; losing an authenticator does not create an entitlement to an administrator override.[9]

For lending, the security page explicitly requires 2FA before contracts and for deposit, withdrawal and payment actions. Trusted Devices adds email confirmation when a new device signs in. The lender, borrower and platform each hold one escrow key; two signatures are required.[15]

Recovery and 2FA investigations can incur time-based fees, with consent except urgent crime or abuse prevention. Invoices or escrow deductions apply; unpaid fees may suspend access.[2]

Aggregate contractual liability cap: US$100, subject to law.[2]

Adults must act for themselves. Citizens, permanent or tax residents, and people located in the US including its territories, Russia, Belarus, Cuba, North Korea, Iran, Iraq, Syria, Sudan, Somalia or comprehensively UN-embargoed jurisdictions are excluded. Sanctioned persons are also barred.[2]

Registration uses an email address, username and password, followed by email confirmation.[6]

An experienced-user-only offer can reject a new trader until they have completed a first contract. Account registration and eligibility for a particular offer are distinct checks.[9]

Privacy is not an assurance of zero personal-data collection. The privacy policy lists trade identifiers, wallet addresses, chats and technical logs; disputes can require identity documents and payment statements. It also describes legacy verified accounts. A public profile can expose reputation and trade statistics.[10]

A trading-data access request is different from a ready-made tax report. The privacy policy offers applicable access/portability rights, including human- or machine-readable copies, and gives a 30-day response period, extendable by two months with notice. Account and transaction records are normally retained for five years after closure or last activity, whichever is later.[10]

The shared Accounts Services page separates a block from a ban. A blocked account can finish existing lending contracts but cannot create new ones; a ban prevents login. Self-deletion is described as irreversible. These access states are more consequential than simply hiding an offer.[16]

Marshall Islands business registration identifies the company. That corporate identifier is not evidence of exchange authorisation or a government compensation scheme.[10]

The current privacy policy identifies Hodlex Ltd, Marshall Islands business number 89220, as controller for both the trading and lending platforms. The shared account service connects the products operationally; they remain different transaction types within one family.[10][16]

Lightning was announced as live in May 2026 alongside the on-chain service. That change added a settlement route within the Bitcoin marketplace, with network selection when creating or accepting offers.[21]

The July guide disables trading offers after ten days offline.[6]

Lending offers become inactive after seven days offline; working hours and suspension can also change visibility.[17]

Accounts may be suspended after over 24 months’ inactivity.[2]

Operator

Hodlex Ltd

Exchange model

Hybrid

Service scope

P2P Bitcoin marketplace; separate lending contracts.

Client types

Retail clients

Pricing publication

Public pricing

Other names

HodlHodl; Lend at Hodl Hodl

Funding scope

Fiat passes between counterparties; Bitcoin funds and leaves contract escrow.

Custody and asset handling

External wallets and multisignature escrow; different on-chain and Lightning signing models.

Client eligibility

Adults; restrictions apply.

Support

Official contact links and contract chat; backup-code recovery instructions.

Authorisation and registration scope

Permission remains unestablished.

Exchange metadata checked 20 Oct 2026Source 1Source 2Source 3Source 4Source 5Source 6Source 7Source 8Source 9Source 10Source 11Source 12Source 13Source 14Source 15Source 16Source 17Source 18Source 19Source 20Source 21

Terms include Ethereum XAUT.[2]

The lending calculation includes agreed interest in the collateral requirement. Hypothetically, a 1,000 USDT loan with 3% interest for the whole term and 50% initial LTV requires 2,060 USDT-equivalent collateral before origination and network charges; repayment is 1,030 USDT. This is a contract illustration, not an annual yield or an executable quote.[14]

The lending payment password is contract-specific and cannot simply be recovered by support. Mutually agreed migration creates a new escrow and new passwords. Its contracts guide distinguishes refund after cancellation from release after repayment, including an administrator-confirmed refund when cancellation happens after the lender-payment stage has begun.[13]

Private lending offers are visible through their link rather than the public list; disabling an offer removes availability until it is re-enabled. Neither action is described as closing an existing loan. Lending reputation comes from counterparties’ positive and negative reviews after completed contracts, rather than a platform guarantee of repayment.[17][18]

The API exposes public offer, currency, country and payment-method data, plus authenticated trading operations. Keys expire after one year. A separate signature key can authorize a release-address instruction and gives an integration materially more access to funds. The documentation contains conflicting general restrictions and signed-request instructions, so implementations must reconcile the exact endpoint before relying on that capability. Disputes and feedback still require the website.[11]

On a temporary 503 API response the documentation instructs retrying later; it does not establish an emergency telephone execution service. Payment-password setup remains a browser step. API data should not be represented as a complete jurisdiction-specific tax statement, and the inspected material did not establish a universal request allowance from its illustrative rate-limit error.[11]

The September 2026 AI article concerns the company’s code-scanning, human review and testnet security work. It is a company account of its security process, not evidence that customers have delegated live trading decisions to an AI agent. No independent effectiveness assessment is implied.[20]