Boltz

Boltz is the *non-custodial bridge between Lightning and on-chain Bitcoin* — a swap service that moves value across the Lightning Network, on-chain BTC, and Liquid without ever taking custody of your coins or asking who you are.

Background. Running since 2018, Boltz built its reputation on *submarine swaps*: atomic exchanges between a Lightning payment and an on-chain (or Liquid) output, coordinated by hash-time-locked contracts (HTLCs) so neither side can cheat. It ships as a browser web app and a mobile wallet (the Boltz app), backed by an open-source server (boltz-backend) and public swap endpoints that other wallets integrate directly. It is reachable on the clearnet and via a Tor v3 onion. That combination of a long operating history, open infrastructure, and a no-account model is why it earns an A in /wallets.

What you trust. Almost nothing — which is the point. Swaps are *trustless via HTLCs*: your funds are locked to a hash preimage such that either the swap completes atomically or you reclaim them via the refund path after a timeout. Boltz never holds spendable custody of your balance the way a custodial exchange does; a swap that fails leaves you able to refund yourself on-chain. The backend is *open source*, so the swap logic and fee handling are auditable, and the *public API* means you're not locked into Boltz's own UI — many third-party Lightning wallets route their swaps through it. The residual trust is operational (liveness, fee quotes), not custodial.

Operational specs. No signup, no email, no KYC — you arrive, pick a direction, and swap. Supported flows include Lightning ⇄ on-chain BTC and Lightning ⇄ Liquid (L-BTC), in both directions, which is exactly what you need to *get funds into or out of Lightning channels without the rebalancing dance*. The mobile app functions as a self-custodial Lightning wallet built on this swap engine; the web app handles one-off swaps. Each swap exposes a refund file/flow so a stuck or expired swap is recoverable by you, not stranded with the operator. Fees are quoted up front per swap. Tor access is first-class via the onion address.

Philosophy. Lightning's hardest UX problem is the on/off ramp — inbound liquidity, channel rebalancing, getting on-chain funds into a channel and back out. Boltz's thesis is that this plumbing should be *trustless and accountless*: you shouldn't have to register with, or hand custody to, an intermediary just to move between Lightning and the base chain. By implementing the bridge as atomic swaps with self-refund, it keeps the user sovereign over their funds throughout — the privacy and self-custody ethos of Bitcoin applied to the part of the stack where most services quietly reintroduce custody and accounts.

Grade rationale. A in /wallets. The grade reflects genuine non-custodial design (HTLC atomicity with a user-controlled refund path), no-account/no-KYC access, an open-source backend, public integrable endpoints, multi-year operation, and a Tor onion. It is best understood not as a general wallet but as the *swap/liquidity layer* — and on that axis it's among the most trustworthy options because it removes custody from the equation entirely.

Useful when. Use Boltz when you need to cross the Lightning/on-chain boundary without giving up custody: emptying a Lightning balance to on-chain BTC or Liquid, topping up a channel from on-chain funds, or getting inbound liquidity without opening a channel manually. It pairs well with privacy-focused Lightning use — moving between Liquid and Lightning, or sweeping LN funds to an on-chain wallet — precisely because there's no account to tie the activity to.

Caveats. Trustless does not mean foolproof: submarine swaps have moving parts, and a swap interrupted at the wrong moment requires you to actually *execute the refund* (save the refund file, follow the flow) — users who close the tab and ignore it can leave funds locked until they reclaim them. On-chain and swap fees apply and can be meaningful for small amounts, so micro-swaps are inefficient. Liquidity and quoted rates depend on Boltz's liveness at swap time. And while there's no account, on-chain and Lightning activity still carry their own chain-analysis surface — Boltz removes the custodial/identity layer, not the inherent traceability of the underlying networks. These are the ordinary trade-offs of a non-custodial swap tool, not trust problems, and they keep it firmly at A for what it is.