Phoenix

Self-custodial mobile Bitcoin Lightning wallet — Apache-2.0, iOS + Android, built and operated by ACINQ (the team behind Eclair, one of the three reference Lightning Network implementations alongside LND and Core Lightning). Phoenix is the wallet ACINQ ships to demonstrate that Lightning self-custody can be friction-free for non-technical users — no channels to manually open, no inbound-liquidity 1% tax, no operator holding your funds between hops. Listed at Grade A because Phoenix is the canonical answer to *"I want self-custodial Lightning without becoming a node operator"* — every architectural decision (single dynamic channel, splicing, trampoline payments) is designed to keep the user model simple while preserving the self-custody guarantee.

What it is. Native mobile app (iOS + Android, plus a desktop preview). On first launch the app provisions a single Lightning channel with ACINQ's LSP (Lightning Service Provider) node and stores your seed locally. From the user's POV there's no channel-management UI — you receive, you spend, the channel resizes itself via splicing when liquidity changes. Under the hood it's Lightning + on-chain primitives orchestrated automatically.

The seed phrase is yours. ACINQ runs the LSP that's the other end of your channel but cannot move your funds — Phoenix is non-custodial in the standard Lightning sense (you hold the keys; the LSP is just a routing counterparty). If ACINQ disappeared tomorrow you could force-close the channel on-chain and reclaim your funds via your seed.

Background. ACINQ has been building Lightning Network infrastructure since 2017 — Eclair (Scala-based reference LN node, used by businesses + the original Eclair Mobile wallet), and ACINQ-the-LSP (one of the larger Lightning routing nodes by capacity). Phoenix succeeded Eclair Mobile in 2019 with a redesigned user model: instead of treating channels as a thing the user manages, treat them as an implementation detail and surface only the wallet/send/receive primitives. The 2024 redesign ("new Phoenix") moved to a single dynamic channel + splicing model, eliminating the prior 1% inbound-liquidity service fee and making channel re-sizing native.

What you trust.

• Apache-2.0 open source at `github.com/ACINQ/phoenix`. Code is auditable; the build is reproducible from source. License is permissive so forks/repackages are legal.
• ACINQ as a public commercial entity. ACINQ SAS is a French-registered company (since 2014) with named principals (Pierre-Marie Padiou, Fabrice Drouin, others) and a multi-year delivery history. Distinct from the anonymous-operator tier — there's a real legal entity + identifiable people behind it.
• You hold the seed. Standard 12/24-word BIP39 seed; if you lose your phone, restore from seed on a fresh install and the channel state syncs back from chain + ACINQ's LSP (which sees your channel commitments but not your keys).
• Force-close-on-chain escape hatch. If ACINQ ever stopped operating their LSP, you could force-close your channel via a chain transaction and recover your funds. The Lightning protocol guarantees this; Phoenix's UX makes it visible.
• Tor support. App connects to its LSP over Tor when the device's system VPN/Tor is enabled. No operator-published `.onion` for Phoenix-the-app (mobile apps don't have onions); the LSP backend has Tor reachability.
• No KYC. No signup, no email, no government-ID upload. Download from F-Droid / App Store / Play / direct APK, restore from seed or generate a new one, send/receive.

Operational specs.

• Install. iOS App Store, Google Play, F-Droid (community-built mirror; check the build matches ACINQ's signed APK), direct APK from GitHub releases. No Play-Services-mandatory features so it runs on de-Google'd Android (GrapheneOS, CalyxOS, /e/OS).
• Platform. iOS, Android. Desktop is in preview.
• Lightning specifics. Single dynamic channel with ACINQ's LSP. Splicing (channel resize without close + reopen) for inbound liquidity. Trampoline payments (offload route-finding to the LSP, reduce mobile compute cost). On-the-fly funding (the LSP funds inbound liquidity on first receive). No 1% inbound-liquidity tax as of the 2024 redesign.
• On-chain primitives. Splice transactions are real on-chain Bitcoin transactions with normal mempool fee dynamics — you pay sat/vB at the prevailing rate when splicing in/out, no surcharge.
• Fees. No platform commission on payments. Service fee on splices disclosed before commitment (typically a small basis-point cut on the splice-in amount + the on-chain fee). LN routing fees pay the network of intermediate nodes (usually <1% end-to-end).
• Backup. Seed phrase is the canonical backup. Channel state lives on-chain + replicated by the LSP; reinstall + restore-from-seed pulls everything back.
• No fiat onramp inside the app. Phoenix is wallet-only; buying Bitcoin happens elsewhere (kyc.rip, KYCnot.me-listed exchanges, P2P, etc.).
• Tor reachability. App routes through system VPN/Tor when configured. Direct in-app Tor toggle: not yet (relies on system-level routing).
• Updates. Frequent release cycle. ACINQ ships signed APKs on GitHub + the standard app-store channels.

Operator philosophy. ACINQ's stated framing across blog posts + their conference talks is that "self-custodial Lightning needs to look like a wallet, not a node-management dashboard." The 2024 splicing redesign was the practical realization of that — Phoenix went from "open channel / close channel / inbound capacity" surfacing to "you have N sats, you can send and receive, the wallet handles the rest." The bet is that most users never want to be node operators, and the only thing standing between Lightning and mass self-custody adoption is the manual channel-management UX baggage.

ACINQ also operates a substantial Lightning routing node (top-N by capacity globally) — that's the LSP backing Phoenix wallets. Distinct from the wallet business but the same team; if you trust ACINQ-the-routing-node you can trust ACINQ-the-LSP, and Phoenix's design treats the LSP as a swappable counterparty (in principle a different LSP could be plugged in via a fork; in practice ACINQ's LSP is the default).

Grade rationale. Grade A because: (1) fully open-source under permissive licence (Apache-2.0, auditable, forkable); (2) named-entity operator accountability — ACINQ SAS is a real legal entity with public principals + a 10+ year LN-infrastructure track record; (3) canonical Lightning self-custody UX — no realistic competitor delivers the same friction-free experience without sacrificing the self-custody property; (4) no KYC anywhere in the flow (no signup, no email, no ID); (5) chain-recoverable — force-close-on-chain escape hatch is preserved by the Lightning protocol itself; (6) F-Droid distribution path + Play-Services-free build so de-Google'd Android works; (7) no security incident attributable to Phoenix-specific code in 5+ years of releases.

The Grade-A ceiling is held by Lightning's general trust model (LSPs and counterparty nodes see your channel commitments, even though they can't touch your funds), which is a Lightning thing, not a Phoenix thing — every self-custodial LN wallet inherits this trade-off. Phoenix mitigates it by being the LSP itself (so you trust one entity, not two), being permissively-licensed (so an alternate-LSP fork is legally viable), and surfacing the chain-recovery path clearly.

Useful when:

• You want self-custodial Bitcoin Lightning on mobile without becoming a node operator.
• You're already on Sparrow / Bitcoin Knots / Wasabi for on-chain and need the matching Lightning mobile companion.
• You're a journalist / activist / aid recipient who needs fast, low-fee, no-KYC Bitcoin payments without trusting a custodial wallet.
• You're donating to or receiving micropayments from projects (xmr.club itself accepts Lightning) and want the lowest-friction self-custodial path.
• You're teaching Lightning to a non-technical user and want to show "this is what self-custody can actually feel like."
• You're a merchant accepting Lightning over BTCPay Server or similar and want a mobile companion wallet for personal spends from your own funds.

Caveats:

• Mobile-only (iOS + Android). Desktop preview exists but isn't yet a primary surface. Power users running a personal node + multi-platform wallet stack will still want LND/CLN + Sparrow/Zeus.
• ACINQ-LSP-dependent. Your single channel terminates at ACINQ's LSP. If ACINQ-the-routing-node went down, you could force-close and recover on-chain — but until then, your day-to-day routing depends on their uptime.
• No in-app Tor toggle. Routes via system VPN/Tor if configured; no Phoenix-specific Tor toggle yet. iOS doesn't trivially support system-Tor without Orbot-equivalents.
• Splice fees are real on-chain transactions. When you splice-in or splice-out, you pay the prevailing Bitcoin mempool sat/vB rate. Not always cheap during fee spikes.
• Single-channel model means single-counterparty. Most Lightning wallets multiplex across channels with multiple LSPs; Phoenix bet on one (ACINQ's). Trade-off: simpler UX, narrower routing topology. ACINQ's mitigation is being the most reliable LSP.
• No fiat onramp in the app. Wallet only; pair with a no-KYC exchange (kyc.rip, the KYCnot-listed engines, P2P) for fiat ramp.
• Lightning generic caveats apply. Backups beyond the seed phrase aren't really a thing — losing the seed means losing the wallet. Channel state recovery requires the LSP to still be operating; the force-close-on-chain escape hatch works regardless but takes longer.
• Play Store + App Store reviews are not the same as a Guix-style reproducible-build trail. ACINQ publishes signed APKs on GitHub so verification is possible, but the formal reproducible-build pipeline that Bitcoin Core ships isn't yet on file for Phoenix. Build from source if you want the highest assurance.