Bitcoin Wallet Sovereignty Matrix (2026): Which Wallet Keeps You Truly Self-Sovereign
“Not your keys, not your coins” is only half the story. Self-custody protects your keys — but if your wallet quietly checks balances against someone else’s server, you have handed a stranger every address you own. Real Bitcoin sovereignty means two things at once: you hold the keys AND your wallet talks to your own node. This matrix scores self-custody wallets on exactly that, plus multisig, hardware-signer interop, coinjoin status and license.
Quick answer
Not your keys, not your coins — but self-custody is only half of sovereignty. The other half is whether your wallet verifies against YOUR OWN node or quietly phones home to someone else's server, handing over every address you own. This matrix scores 16 self-custody Bitcoin wallets on the properties that actually decide that: node connection (own full node, own Electrum server, or third-party), keys custody, multisig, hardware-signer interop, Tor, and license. The sovereignty score is transparent and objective — see the rubric below the table.
Sovereignty gold standard (own node by default, open source, real multisig): Sparrow and Specter Desktop on the desktop, with Bitcoin Core as the maximal baseline — the wallet IS your node. For miniscript timelock/inheritance vaults, Liana; for collaborative multisig on mobile, Nunchuk. License watch — the honest 2026 realities most wallet lists get wrong: (1) COINJOIN IS LARGELY DEAD out of the box — Samourai was seized and its founders sentenced (Nov 2025), so Sparrow REMOVED Whirlpool (v1.9.0) and Wasabi's coordinator shut in June 2024 (bring-your-own coordinator only); the Ashigaru fork is the one living Whirlpool, but it needs your own Dojo and carries the exact legal-risk profile the DOJ just prosecuted. (2) SELF-CUSTODY IS NOT SOVEREIGNTY: only 4 of these 16 (Bitcoin Core, Specter, Sparrow, Ashigaru) talk to YOUR node by default — Electrum and most mobile wallets auto-connect to a vendor or public server, leaking every address you own even though your keys stay put. Repoint them at your own node. Free CSV/JSON under CC BY 4.0.
Download CSV Download JSON REST API →
Score = objective sovereignty rubric (below). green/grey = yes/no. Seized or discontinued wallets are shown last and are NOT recommended. ~ = lower-confidence.
| Wallet | Sov. | Platforms | Node connection | Multisig | Signer interop | Coinjoin (2026) | Lightning | License |
|---|---|---|---|---|---|---|---|---|
| Sparrow Wallet Craig Raw | 10 | desktop, cli (headless/terminal mode), hardware-companion | own full node (Bitcoin Core) OR own Electrum server (electrs/Fulcrum) — chosen at first launch; NO silent developer server (public Electrum servers are opt-in only). Own-node-first by design. | yes (coordinator) | USB (Ledger, Trezor, BitBox02); air-gap via QR (SeedSigner, Keystone, Passport, Jade) and SD/QR (Coldcard). Broadest signer support of the set. | deprecated (Whirlpool) — Whirlpool client + Soroban features fully REMOVED in v1.9.0 (Apr 2024) after the Samourai seizure; Sparrow has NO working coinjoin | no | Apache-2.0 |
| Specter Desktop cryptoadvance / Specter Solutions | 10 | desktop (multisig coordinator for air-gapped signers) | own full node (Bitcoin Core) by default; own electrs/Fulcrum also supported. No third-party default — designed to sit on YOUR node. | yes (coordinator) — its flagship purpose | USB (Trezor, Ledger, BitBox02, Specter-DIY); air-gap via QR + SD (Coldcard, SeedSigner, Keystone, Passport, Jade) | no | no | MIT |
| Bitcoin Core (wallet) Bitcoin Core contributors | 9 | desktop (bitcoin-qt GUI), cli (bitcoin-cli / bitcoind RPC) | own full node — the wallet IS your node; no third-party server exists in the path. The sovereignty baseline; own-node by definition. | yes (participant + coordinator, manual via descriptors + PSBT; no guided GUI) | via HWI on CLI; otherwise PSBT export to any external signer. No native in-GUI signer flow. | no | no | MIT |
| Blockstream Green Blockstream | 8 | mobile (iOS, Android), desktop (Windows, macOS, Linux) | DEFAULT is Blockstream's Green/Electrum backend; a 'Personal Node' setting connects your own Electrum server, plus optional SPV full-node validation (Android). | participant — 'Multisig Shield' is assisted 2-of-2 / 2-of-3 with Blockstream as 2FA co-signer, NOT a general external-signer coordinator; singlesig accounts are standard BIP84 | air-gap QR + USB (desktop) + BLE (Jade); Blockstream Jade, Ledger, Trezor | no | self-custodial via Greenlight (Breez SDK) — keys on device, LN node hosted on Blockstream cloud | Apps GPL/AGPL-family; underlying gdk under a custom Blockstream license (verify per repo) |
| BlueWallet BlueWallet Services | 8 | mobile (iOS, Android), macOS (Catalyst), Apple Watch | DEFAULT is BlueWallet's public Electrum servers; you can point it at your own Electrum Personal Server / electrs / ElectrumX. LN now requires your OWN LNDHub/LND. | yes (coordinator) | air-gap QR (animated BC-UR) + microSD (Coldcard) + PSBT file; QR/file-based signers, no USB (mobile) | no | self-custodial only — the vendor custodial LNDHub node (lndhub.io) was fully SHUT DOWN in 2023 (final deadline 31 May 2023). Lightning works only if you run your own LNDHub/LND. (Candidate's 'being sunset' was outdated — it is already gone.) | MIT |
| Nunchuk Nunchuk (Hugo Nguyen / Nunchuk Pte Ltd) | 8 | mobile (iOS, Android), desktop (macOS, Windows, Linux) | DEFAULT is Nunchuk's own Electrum-protocol server, but you can point it at your own ElectrumX/electrs/Fulcrum or a Bitcoin Core node (works with Umbrel/Start9/myNode). Can run over Tor. | yes (coordinator) | air-gap QR (BC-UR) + USB (desktop) + microSD + NFC; Coldcard, Jade, SeedSigner, Passport, Trezor, Ledger, BitBox, TAPSIGNER/SATSCARD, plus encrypted software keys | no | no (on-chain multisig / collaborative-custody focus; not a self-custodial LN wallet) | GPL-3.0 (apps + libnunchuk). NOTE: the multi-device sync/coordination backend is proprietary (open-core), though an optional self-hosted relay + e2e-encrypted sync exist for the sync layer. |
| Ashigaru (Wallet + Whirlpool/Terminal) Ashigaru Open Source Project (anonymous; fork of Samourai Wallet source frozen at 2024-04-24) | 7 | mobile (Android) + desktop CLI/TUI (Ashigaru Terminal — Windows, macOS, Linux) | own full node — the Android wallet REQUIRES your own Dojo node for full functionality (else offline mode); Ashigaru Terminal (Whirlpool) uses an Electrum-server backend (electrs on Start9/Umbrel/myNode), removing the Dojo dependency. | no | n/a — hot wallet (BIP84 + BIP47 PayNyms); no hardware-signer interop | yes — Ashigaru Whirlpool is the ONLY working coinjoin in this matrix; new Zerolink coordinator live since mid-2025 (v1.0.0), ACTIVE 2026, Tor-only, pools 0.025 & 0.25 BTC, 5% fee | no | Samourai-derived open source (verify exact terms per Ashigaru repo) |
| Bull Bitcoin Wallet Bull Bitcoin / Satoshi Portal | 7 | mobile (iOS, Android) | DEFAULT is Bull Bitcoin's no-log Electrum server (Blockstream secondary); you can point at your own Electrum server; Mempool instance for fees; Tor supported. | no | watch-only import (xpub/ypub/zpub, Coldcard file, NFC, QR) + PSBT export for offline signing; single-sig, not a multisig coordinator | no | self-custodial via Boltz non-custodial atomic swaps (funds held on Liquid at rest, swapped in/out of LN) — no channel management | MIT |
| Electrum Thomas Voegtlin / spesmilo | 7 | desktop, mobile (Android), cli | third-party server BY DEFAULT — auto-connects to PUBLIC ElectrumX servers (an ADDRESS-PRIVACY LEAK even though keys stay local). Can and should be repointed at your own electrs/Fulcrum/ElectrumX/EPS for sovereignty. | yes (coordinator) | USB (Ledger, Trezor, Coldcard, BitBox02, KeepKey); air-gap via PSBT file/QR (Coldcard, SeedSigner) | no | self-custodial (native Electrum Lightning; submarine swaps, watchtowers) | MIT |
| Liana Wizardsardine | 7 | desktop (GUI), cli (lianad daemon), hardware-companion | own full node (Bitcoin Core, managed v27.1) OR own Electrum server (electrs/Fulcrum, added in v7.0) — both first-class; 'Liana Connect' (Wizardsardine-hosted) is an OPTIONAL no-node convenience, not a forced default. Default depends on the setup path chosen. | yes (coordinator) — miniscript spending policies incl. multisig combined with timelocked recovery paths | USB (Ledger, BitBox02); air-gap/SD (Coldcard, Specter-DIY); tap-miniscript signers for Taproot policies (Ledger, Coldcard, Specter-DIY, BitBox02 fw 9.21+) | no | no | BSD-3-Clause |
| BitBoxApp BitBox (Shift Crypto AG) | 6 | desktop, mobile (Android/iOS), hardware-companion (BitBox02) | third-party server BY DEFAULT — BitBox/Shift's own electrs servers (non-custodial but leaks addresses to Shift). Can be repointed at your own Electrum server (electrs/EPS/Fulcrum) in Advanced Settings. | participant (BitBox02 signs; multisig must be coordinated in Sparrow/Electrum/Nunchuk — BitBoxApp has no multisig coordinator UI) | native pairing with BitBox02 only (USB desktop; USB/BLE mobile); not a general multi-signer coordinator | no | self-custodial via Breez SDK (LSP-assisted; beta; non-custodial keys) | Apache-2.0 |
| Envoy (by Foundation) Foundation Devices | 6 | mobile (iOS, Android); hardware-companion to Foundation Passport / Passport Prime | third-party server by DEFAULT (Foundation's Electrum-protocol servers) — but 'Add Node' connects your own Electrum/Fulcrum or full node to remove reliance on Foundation entirely; Tor built-in. | no | air-gap QR (animated UR/BBQr) + BLE (Passport Prime) + microSD; purpose-built companion for Foundation Passport signing | no | no (Bitcoin on-chain only) | GPL-3.0-or-later |
| Phoenix ACINQ | 5 | mobile (iOS, Android) | third-party by DEFAULT — a lightweight Eclair node runs on your phone but depends on ACINQ as its SOLE mandatory LSP for liquidity/routing/backup; on-chain data comes from a random public Electrum server. You CAN set your own Electrum for on-chain in advanced settings, but the ACINQ LSP dependency is not removable. | no | n/a — 12-word seed on device; no hardware-signer interop | no | self-custodial (Eclair) via a single dynamic channel resized by splicing; MANDATORY sole dependency on ACINQ as LSP; BOLT12 supported; ACINQ calls it 'trust-minimized, not trustless' | Apache-2.0 |
| Wasabi Wallet zkSNACKs (original) — now community-maintained open-source | 5 | desktop | client-side BIP158 block filters. v2.6+ ('Prometheus') can sync and operate WITHOUT any central backend, connecting directly to your own full node (ships Bitcoin Knots for one-click local node); when a filter hits, the block is pulled from your node. Historically fetched filters from the zkSNACKs backend. | no | USB via HWI (Coldcard, Trezor, Ledger, BitBox02) for watch-only + PSBT signing | deprecated (WabiSabi) — zkSNACKs coordinator shut 1 Jun 2024; coinjoin only works if you select a third-party/self-hosted coordinator (v2.0.8+ 'Change Coordinator' UI; ~9 community coordinators; Ginger fork ships a default). NOT working out of the box. | no | MIT |
| ZEUS ZEUS LN (Evan Kaloudis) | 5 | mobile (iOS, Android) | flagship sovereign use = remote-control YOUR OWN LND / Core Lightning / Eclair (REST/gRPC/LNC/Tor); alternatively an embedded self-custodial node (LDK Node default, formerly embedded LND) using Neutrino/SPV. On-chain via public Electrum unless own set. | no | n/a — connects to LN node backends (LND/CLN/Eclair) or embedded LDK; not a hardware-signer wallet | no | self-custodial when connected to your own LND/CLN/Eclair or the embedded LDK node — BUT the new 'Mortal' onboarding tier DEFAULTS new users to CUSTODIAL Cashu ecash (the mint holds funds) before graduating them to the self-custodial 'God' tier node | AGPL-3.0 |
| Samourai Wallet (reference row — SEIZED, DO NOT FUND) SEIZED/DEFUNCT Samourai Wallet LLC — founders Keonne Rodriguez & William Lonergan Hill arrested Apr 2024, pleaded guilty, sentenced Nov 2025 to 5 and 4 years | 5 | mobile (Android) — no longer distributed (removed from Play Store; infra/domain seized) | own full node (Dojo) historically — but the project's coordinator/backend/domains were SEIZED, so live use is defunct | no | n/a — hot wallet (BIP84 + BIP47 PayNyms); historical cold pairing via Sparrow/Passport (Sencha) | deprecated (Whirlpool) — coordinator SEIZED 24 Apr 2024; defunct. Root cause of Sparrow's removed Whirlpool client (v1.9.0). Revived separately by the Ashigaru fork. | no | Source-available (Unlicense-era) |
Sovereignty score rubric (0-10, objective). Node connection: own node by default +3, else (defaults to a vendor server but repointable to your own node) +1. Open source +2. Self-custody keys +1. Multisig coordinator +1. Built-in Tor +1. Air-gapped signer interop +1. Descriptors +1. The score measures sovereignty PROPERTIES only — not usability, UX or security audits — so read it alongside the columns, not instead of them. This is the software-coordinator companion to the hardware signing-device dataset: pick a wallet here, pair it with a signer there. Part of D-Central's sovereignty vertical and self-hosting hub. Verify each project before trusting funds.
Pick a wallet here and pair it with a device from the Bitcoin hardware signing devices comparison — the wallet coordinates, the signer holds the keys. Then give it a home to talk to: a Bitcoin node appliance or a DIY node from the self-hosting hub. Part of D-Central’s sovereignty vertical — because keeping your keys, your node and your privacy is the whole point.
Related products, repair, and setup paths
- how D-Central diagnoses ASIC repairs
- ASIC troubleshooting library
- ASIC manuals and repair guides
- replacement hashboards
- ASIC control boards
- ASIC power supplies
- S19 family replacement hashboard
- C52 replacement control board
- APW12 S19 power supply
- immersion cooling hub
- home immersion cooling guide
- ASIC miners for immersion planning
- ASIC cooling parts
- airflow shroud before immersion
- compare miner specs in the database
- ASIC repair support
- Antminer S9 specs
- Bitmain Antminer S9
- Antminer S9 maintenance guide
- S9 hashboard repair parts bundle
Last reviewed July 17, 2026.