Trustonion
Three structural features make exit-scamming architecturally awkward on Nexus Market: multisig escrow, signed feedback, client-side encryption.
Multisig escrow. 2-of-3 means buyer, vendor, and platform each hold one key; any two are required for movement. The platform alone cannot move funds; coordinated theft would require flipping 92 percent of vendors against their own balances, which has never happened in any post-Hydra market. Signed feedback. Buyer ratings are PGP-signed at write time, replicated off-server. The platform cannot rewrite or delete a rating; vendor reputation outlives platform-level events. Client-side encryption. Sensitive payloads are encrypted in the browser before transmission; the platform's on-disk state is per-session-keyed ciphertext. A seizure yields no useful plaintext.
None of these guarantees nothing-can-go-wrong. They establish that an exit-scam would require visibly anomalous on-chain behaviour, and the on-chain record has been clean for two years.