{ "meta": { "title": "D-Central — Bitcoin Wallet Sovereignty Matrix", "description": "Self-custody Bitcoin wallets (16) scored on node connection, keys custody, multisig, hardware-signer interop, coinjoin/payjoin status, Tor and license — which wallet keeps you non-custodial AND connects to your own node.", "generated": "2026-07-17T18:48:10+00:00", "last_verified": "July 2026", "version": "1.0", "license": "https://creativecommons.org/licenses/by/4.0/", "license_name": "CC BY 4.0", "source": "https://d-central.tech/bitcoin-wallet-sovereignty-matrix/", "record_count": 16, "score_rubric": "sovereignty_score (0-10): own node by DEFAULT +3, else (defaults to a vendor server, repointable to your own) +1; open source +2; self-custody keys +1; multisig coordinator +1; built-in Tor +1; air-gapped signer interop +1; descriptors +1 (capped 10).", "provenance": "Each wallet's official site + GitHub, reconciled adversarially. Coinjoin status is 2026-current (Samourai/Whirlpool seized Apr 2024; Wasabi/zkSNACKs coordinator shut June 2024).", "disclaimer": "The score reflects sovereignty properties only, not usability or security audits. Seized/discontinued wallets are listed for reference and are NOT recommended. Verify the current project before trusting funds." }, "rows": [ { "wallet_id": "sparrow", "name": "Sparrow Wallet", "developer": "Craig Raw", "platforms": "desktop, cli (headless/terminal mode), hardware-companion", "node_connection": "own full node (Bitcoin Core) OR own Electrum server (electrs/Fulcrum) — chosen at first launch; NO silent developer server (public Electrum servers are opt-in only). Own-node-first by design.", "node_sovereign_default": true, "custody": "self-custody", "watch_only": true, "descriptors": true, "psbt": true, "multisig": "yes (coordinator)", "signer_interop": "USB (Ledger, Trezor, BitBox02); air-gap via QR (SeedSigner, Keystone, Passport, Jade) and SD/QR (Coldcard). Broadest signer support of the set.", "coinjoin": "deprecated (Whirlpool) — Whirlpool client + Soroban features fully REMOVED in v1.9.0 (Apr 2024) after the Samourai seizure; Sparrow has NO working coinjoin", "payjoin": true, "miniscript_timelock": false, "tor": true, "lightning": "no", "license": "Apache-2.0", "open_source": true, "status": "active", "status_note": "Coinjoin removed v1.9.0; still a top-tier own-node PSBT/multisig wallet.", "best_for": "The desktop power-user default — own-node-first with best-in-class PSBT, multisig and air-gap UX", "source_url": "https://sparrowwallet.com/docs/", "confidence": "high", "sovereignty_score": 10 }, { "wallet_id": "specter-desktop", "name": "Specter Desktop", "developer": "cryptoadvance / Specter Solutions", "platforms": "desktop (multisig coordinator for air-gapped signers)", "node_connection": "own full node (Bitcoin Core) by default; own electrs/Fulcrum also supported. No third-party default — designed to sit on YOUR node.", "node_sovereign_default": true, "custody": "self-custody (watch-only coordinator; keys never leave the hardware signers)", "watch_only": true, "descriptors": true, "psbt": true, "multisig": "yes (coordinator) — its flagship purpose", "signer_interop": "USB (Trezor, Ledger, BitBox02, Specter-DIY); air-gap via QR + SD (Coldcard, SeedSigner, Keystone, Passport, Jade)", "coinjoin": "no", "payjoin": false, "miniscript_timelock": false, "tor": true, "lightning": "no", "license": "MIT", "open_source": true, "status": "active", "status_note": "Own-node-first by default. Verify current maintenance cadence per repo before relying on it as a primary coordinator.", "best_for": "Bitcoin Core-native multisig coordinator for a fleet of air-gapped hardware signers", "source_url": "https://github.com/cryptoadvance/specter-desktop", "confidence": "high", "sovereignty_score": 10 }, { "wallet_id": "bitcoin-core-wallet", "name": "Bitcoin Core (wallet)", "developer": "Bitcoin Core contributors", "platforms": "desktop (bitcoin-qt GUI), cli (bitcoin-cli / bitcoind RPC)", "node_connection": "own full node — the wallet IS your node; no third-party server exists in the path. The sovereignty baseline; own-node by definition.", "node_sovereign_default": true, "custody": "self-custody", "watch_only": true, "descriptors": true, "psbt": true, "multisig": "yes (participant + coordinator, manual via descriptors + PSBT; no guided GUI)", "signer_interop": "via HWI on CLI; otherwise PSBT export to any external signer. No native in-GUI signer flow.", "coinjoin": "no", "payjoin": false, "miniscript_timelock": true, "tor": true, "lightning": "no", "license": "MIT", "open_source": true, "status": "active", "status_note": null, "best_for": "Maximal sovereignty — your own node IS the wallet backend; the descriptor + PSBT reference implementation", "source_url": "https://bitcoincore.org/en/doc/", "confidence": "high", "sovereignty_score": 9 }, { "wallet_id": "blockstream-green", "name": "Blockstream Green", "developer": "Blockstream", "platforms": "mobile (iOS, Android), desktop (Windows, macOS, Linux)", "node_connection": "DEFAULT is Blockstream's Green/Electrum backend; a 'Personal Node' setting connects your own Electrum server, plus optional SPV full-node validation (Android).", "node_sovereign_default": false, "custody": "self-custody (keys on device). The 2FA 'Multisig Shield' adds Blockstream as an assisted co-signer; Lightning runs self-custodially on Blockstream's Greenlight cloud infra.", "watch_only": true, "descriptors": true, "psbt": true, "multisig": "participant — 'Multisig Shield' is assisted 2-of-2 / 2-of-3 with Blockstream as 2FA co-signer, NOT a general external-signer coordinator; singlesig accounts are standard BIP84", "signer_interop": "air-gap QR + USB (desktop) + BLE (Jade); Blockstream Jade, Ledger, Trezor", "coinjoin": "no", "payjoin": false, "miniscript_timelock": true, "tor": true, "lightning": "self-custodial via Greenlight (Breez SDK) — keys on device, LN node hosted on Blockstream cloud", "license": "Apps GPL/AGPL-family; underlying gdk under a custom Blockstream license (verify per repo)", "open_source": true, "status": "active", "status_note": "Defaults to Blockstream backend; own-Electrum opt-in. Multisig is 2FA-assisted (participant), not open coordination.", "best_for": "Easy self-custody paired with Jade, own-node option, singlesig or 2FA-assisted accounts", "source_url": "https://github.com/Blockstream/green_android", "confidence": "high", "sovereignty_score": 8 }, { "wallet_id": "bluewallet", "name": "BlueWallet", "developer": "BlueWallet Services", "platforms": "mobile (iOS, Android), macOS (Catalyst), Apple Watch", "node_connection": "DEFAULT is BlueWallet's public Electrum servers; you can point it at your own Electrum Personal Server / electrs / ElectrumX. LN now requires your OWN LNDHub/LND.", "node_sovereign_default": false, "custody": "self-custody (on-chain). Lightning is self-custody only after the vendor custodial service closed.", "watch_only": true, "descriptors": true, "psbt": true, "multisig": "yes (coordinator)", "signer_interop": "air-gap QR (animated BC-UR) + microSD (Coldcard) + PSBT file; QR/file-based signers, no USB (mobile)", "coinjoin": "no", "payjoin": false, "miniscript_timelock": false, "tor": true, "lightning": "self-custodial only — the vendor custodial LNDHub node (lndhub.io) was fully SHUT DOWN in 2023 (final deadline 31 May 2023). Lightning works only if you run your own LNDHub/LND. (Candidate's 'being sunset' was outdated — it is already gone.)", "license": "MIT", "open_source": true, "status": "active", "status_note": "CORRECTED: custodial Lightning discontinued 2023, not 'being sunset'. LN is BYO-LNDHub/LND now.", "best_for": "Beginner on-chain + optional own-Electrum and own-LNDHub self-custodial Lightning", "source_url": "https://bluewallet.io/sunsetting-lndhub/", "confidence": "high", "sovereignty_score": 8 }, { "wallet_id": "nunchuk", "name": "Nunchuk", "developer": "Nunchuk (Hugo Nguyen / Nunchuk Pte Ltd)", "platforms": "mobile (iOS, Android), desktop (macOS, Windows, Linux)", "node_connection": "DEFAULT is Nunchuk's own Electrum-protocol server, but you can point it at your own ElectrumX/electrs/Fulcrum or a Bitcoin Core node (works with Umbrel/Start9/myNode). Can run over Tor.", "node_sovereign_default": false, "custody": "self-custody (collaborative/inheritance multisig focus)", "watch_only": true, "descriptors": true, "psbt": true, "multisig": "yes (coordinator)", "signer_interop": "air-gap QR (BC-UR) + USB (desktop) + microSD + NFC; Coldcard, Jade, SeedSigner, Passport, Trezor, Ledger, BitBox, TAPSIGNER/SATSCARD, plus encrypted software keys", "coinjoin": "no", "payjoin": false, "miniscript_timelock": true, "tor": true, "lightning": "no (on-chain multisig / collaborative-custody focus; not a self-custodial LN wallet)", "license": "GPL-3.0 (apps + libnunchuk). NOTE: the multi-device sync/coordination backend is proprietary (open-core), though an optional self-hosted relay + e2e-encrypted sync exist for the sync layer.", "open_source": true, "status": "active", "status_note": "Open-core: client GPL-3.0, sync backend proprietary (self-hosted relay optional). Own-node option confirmed.", "best_for": "Collaborative / inheritance multisig on mobile with genuine hardware-signer interop and own-node option", "source_url": "https://github.com/nunchuk-io/libnunchuk", "confidence": "high", "sovereignty_score": 8 }, { "wallet_id": "ashigaru", "name": "Ashigaru (Wallet + Whirlpool/Terminal)", "developer": "Ashigaru Open Source Project (anonymous; fork of Samourai Wallet source frozen at 2024-04-24)", "platforms": "mobile (Android) + desktop CLI/TUI (Ashigaru Terminal — Windows, macOS, Linux)", "node_connection": "own full node — the Android wallet REQUIRES your own Dojo node for full functionality (else offline mode); Ashigaru Terminal (Whirlpool) uses an Electrum-server backend (electrs on Start9/Umbrel/myNode), removing the Dojo dependency.", "node_sovereign_default": true, "custody": "self-custody", "watch_only": false, "descriptors": false, "psbt": false, "multisig": "no", "signer_interop": "n/a — hot wallet (BIP84 + BIP47 PayNyms); no hardware-signer interop", "coinjoin": "yes — Ashigaru Whirlpool is the ONLY working coinjoin in this matrix; new Zerolink coordinator live since mid-2025 (v1.0.0), ACTIVE 2026, Tor-only, pools 0.025 & 0.25 BTC, 5% fee", "payjoin": true, "miniscript_timelock": false, "tor": true, "lightning": "no", "license": "Samourai-derived open source (verify exact terms per Ashigaru repo)", "open_source": true, "status": "active", "status_note": "Only living Whirlpool coinjoin. Anonymous devs + Samourai-derived code = the exact legal-risk profile the DOJ just prosecuted; requires own Dojo/Electrum. Confidence medium.", "best_for": "On-chain privacy diehards who run their own Dojo/Electrum and want the REVIVED Whirlpool coinjoin (new Zerolink coordinator, Tor-only)", "source_url": "https://www.nobsbitcoin.com/ashigaru-whirlpool-and-terminal-v1-0-0/", "confidence": "medium", "sovereignty_score": 7 }, { "wallet_id": "bull-bitcoin", "name": "Bull Bitcoin Wallet", "developer": "Bull Bitcoin / Satoshi Portal", "platforms": "mobile (iOS, Android)", "node_connection": "DEFAULT is Bull Bitcoin's no-log Electrum server (Blockstream secondary); you can point at your own Electrum server; Mempool instance for fees; Tor supported.", "node_sovereign_default": false, "custody": "self-custody", "watch_only": true, "descriptors": true, "psbt": true, "multisig": "no", "signer_interop": "watch-only import (xpub/ypub/zpub, Coldcard file, NFC, QR) + PSBT export for offline signing; single-sig, not a multisig coordinator", "coinjoin": "no", "payjoin": true, "miniscript_timelock": false, "tor": true, "lightning": "self-custodial via Boltz non-custodial atomic swaps (funds held on Liquid at rest, swapped in/out of LN) — no channel management", "license": "MIT", "open_source": true, "status": "active", "status_note": "Defaults to Bull's Electrum server; own-node opt-in. Integrated non-custodial exchange.", "best_for": "Self-custodial BTC + Liquid with async Payjoin and swap-based Lightning, plus integrated non-custodial exchange", "source_url": "https://github.com/SatoshiPortal/bullbitcoin-mobile", "confidence": "high", "sovereignty_score": 7 }, { "wallet_id": "electrum", "name": "Electrum", "developer": "Thomas Voegtlin / spesmilo", "platforms": "desktop, mobile (Android), cli", "node_connection": "third-party server BY DEFAULT — auto-connects to PUBLIC ElectrumX servers (an ADDRESS-PRIVACY LEAK even though keys stay local). Can and should be repointed at your own electrs/Fulcrum/ElectrumX/EPS for sovereignty.", "node_sovereign_default": false, "custody": "self-custody + optional self-custodial Lightning", "watch_only": true, "descriptors": false, "psbt": true, "multisig": "yes (coordinator)", "signer_interop": "USB (Ledger, Trezor, Coldcard, BitBox02, KeepKey); air-gap via PSBT file/QR (Coldcard, SeedSigner)", "coinjoin": "no", "payjoin": true, "miniscript_timelock": false, "tor": true, "lightning": "self-custodial (native Electrum Lightning; submarine swaps, watchtowers)", "license": "MIT", "open_source": true, "status": "active", "status_note": "Defaults to public ElectrumX servers — sovereign only once repointed to your own server.", "best_for": "Fast, scriptable veteran wallet — sovereign only once you repoint it off the public servers", "source_url": "https://electrum.org/", "confidence": "high", "sovereignty_score": 7 }, { "wallet_id": "liana", "name": "Liana", "developer": "Wizardsardine", "platforms": "desktop (GUI), cli (lianad daemon), hardware-companion", "node_connection": "own full node (Bitcoin Core, managed v27.1) OR own Electrum server (electrs/Fulcrum, added in v7.0) — both first-class; 'Liana Connect' (Wizardsardine-hosted) is an OPTIONAL no-node convenience, not a forced default. Default depends on the setup path chosen.", "node_sovereign_default": false, "custody": "self-custody", "watch_only": true, "descriptors": true, "psbt": true, "multisig": "yes (coordinator) — miniscript spending policies incl. multisig combined with timelocked recovery paths", "signer_interop": "USB (Ledger, BitBox02); air-gap/SD (Coldcard, Specter-DIY); tap-miniscript signers for Taproot policies (Ledger, Coldcard, Specter-DIY, BitBox02 fw 9.21+)", "coinjoin": "no", "payjoin": false, "miniscript_timelock": true, "tor": false, "lightning": "no", "license": "BSD-3-Clause", "open_source": true, "status": "active", "status_note": "v7.0 added own-Electrum backend; no built-in Tor.", "best_for": "Miniscript timelock / decaying-multisig for inheritance and loss-recovery vaults", "source_url": "https://wizardsardine.com/liana/", "confidence": "high", "sovereignty_score": 7 }, { "wallet_id": "bitboxapp", "name": "BitBoxApp", "developer": "BitBox (Shift Crypto AG)", "platforms": "desktop, mobile (Android/iOS), hardware-companion (BitBox02)", "node_connection": "third-party server BY DEFAULT — BitBox/Shift's own electrs servers (non-custodial but leaks addresses to Shift). Can be repointed at your own Electrum server (electrs/EPS/Fulcrum) in Advanced Settings.", "node_sovereign_default": false, "custody": "self-custody + optional self-custodial Lightning (beta)", "watch_only": true, "descriptors": false, "psbt": true, "multisig": "participant (BitBox02 signs; multisig must be coordinated in Sparrow/Electrum/Nunchuk — BitBoxApp has no multisig coordinator UI)", "signer_interop": "native pairing with BitBox02 only (USB desktop; USB/BLE mobile); not a general multi-signer coordinator", "coinjoin": "no", "payjoin": false, "miniscript_timelock": false, "tor": true, "lightning": "self-custodial via Breez SDK (LSP-assisted; beta; non-custodial keys)", "license": "Apache-2.0", "open_source": true, "status": "active", "status_note": "Defaults to Shift's servers; own-node is opt-in. Multisig is participant-only.", "best_for": "Easiest way to run a BitBox02 — with the option (not the default) to point at your own node", "source_url": "https://github.com/BitBoxSwiss/bitbox-wallet-app", "confidence": "medium", "sovereignty_score": 6 }, { "wallet_id": "envoy", "name": "Envoy (by Foundation)", "developer": "Foundation Devices", "platforms": "mobile (iOS, Android); hardware-companion to Foundation Passport / Passport Prime", "node_connection": "third-party server by DEFAULT (Foundation's Electrum-protocol servers) — but 'Add Node' connects your own Electrum/Fulcrum or full node to remove reliance on Foundation entirely; Tor built-in.", "node_sovereign_default": false, "custody": "self-custody", "watch_only": true, "descriptors": false, "psbt": true, "multisig": "no", "signer_interop": "air-gap QR (animated UR/BBQr) + BLE (Passport Prime) + microSD; purpose-built companion for Foundation Passport signing", "coinjoin": "no", "payjoin": false, "miniscript_timelock": false, "tor": true, "lightning": "no (Bitcoin on-chain only)", "license": "GPL-3.0-or-later", "open_source": true, "status": "active", "status_note": "Defaults to Foundation servers; own-node opt-in with strong built-in Tor.", "best_for": "Privacy-preserving mobile companion for a Foundation Passport with strong Tor + own-node option", "source_url": "https://github.com/Foundation-Devices/envoy", "confidence": "high", "sovereignty_score": 6 }, { "wallet_id": "phoenix", "name": "Phoenix", "developer": "ACINQ", "platforms": "mobile (iOS, Android)", "node_connection": "third-party by DEFAULT — a lightweight Eclair node runs on your phone but depends on ACINQ as its SOLE mandatory LSP for liquidity/routing/backup; on-chain data comes from a random public Electrum server. You CAN set your own Electrum for on-chain in advanced settings, but the ACINQ LSP dependency is not removable.", "node_sovereign_default": false, "custody": "self-custody (keys on device, recoverable via 12-word seed even if ACINQ disappears)", "watch_only": false, "descriptors": false, "psbt": false, "multisig": "no", "signer_interop": "n/a — 12-word seed on device; no hardware-signer interop", "coinjoin": "no", "payjoin": false, "miniscript_timelock": false, "tor": true, "lightning": "self-custodial (Eclair) via a single dynamic channel resized by splicing; MANDATORY sole dependency on ACINQ as LSP; BOLT12 supported; ACINQ calls it 'trust-minimized, not trustless'", "license": "Apache-2.0", "open_source": true, "status": "active", "status_note": "Genuinely self-custodial keys, but hard-wired to ACINQ as the only LSP; on-chain defaults to a public Electrum.", "best_for": "The easiest genuinely self-custodial Lightning wallet (splicing, one dynamic channel, no channel management)", "source_url": "https://github.com/ACINQ/phoenix", "confidence": "high", "sovereignty_score": 5 }, { "wallet_id": "wasabi", "name": "Wasabi Wallet", "developer": "zkSNACKs (original) — now community-maintained open-source", "platforms": "desktop", "node_connection": "client-side BIP158 block filters. v2.6+ ('Prometheus') can sync and operate WITHOUT any central backend, connecting directly to your own full node (ships Bitcoin Knots for one-click local node); when a filter hits, the block is pulled from your node. Historically fetched filters from the zkSNACKs backend.", "node_sovereign_default": false, "custody": "self-custody", "watch_only": true, "descriptors": false, "psbt": true, "multisig": "no", "signer_interop": "USB via HWI (Coldcard, Trezor, Ledger, BitBox02) for watch-only + PSBT signing", "coinjoin": "deprecated (WabiSabi) — zkSNACKs coordinator shut 1 Jun 2024; coinjoin only works if you select a third-party/self-hosted coordinator (v2.0.8+ 'Change Coordinator' UI; ~9 community coordinators; Ginger fork ships a default). NOT working out of the box.", "payjoin": true, "miniscript_timelock": false, "tor": true, "lightning": "no", "license": "MIT", "open_source": true, "status": "active", "status_note": "Coinjoin requires a third-party/self-hosted coordinator since Jun 2024; v2.6+ can run backend-free on your own node.", "best_for": "Client-side-filter privacy wallet with own-node sync — but coinjoin now requires a third-party/self-hosted coordinator", "source_url": "https://www.nobsbitcoin.com/wasabi-wallet-v2-6-0/", "confidence": "high", "sovereignty_score": 5 }, { "wallet_id": "zeus", "name": "ZEUS", "developer": "ZEUS LN (Evan Kaloudis)", "platforms": "mobile (iOS, Android)", "node_connection": "flagship sovereign use = remote-control YOUR OWN LND / Core Lightning / Eclair (REST/gRPC/LNC/Tor); alternatively an embedded self-custodial node (LDK Node default, formerly embedded LND) using Neutrino/SPV. On-chain via public Electrum unless own set.", "node_sovereign_default": false, "custody": "self-custody CAPABLE, but custodial-by-default for new users", "watch_only": false, "descriptors": false, "psbt": false, "multisig": "no", "signer_interop": "n/a — connects to LN node backends (LND/CLN/Eclair) or embedded LDK; not a hardware-signer wallet", "coinjoin": "no", "payjoin": false, "miniscript_timelock": false, "tor": true, "lightning": "self-custodial when connected to your own LND/CLN/Eclair or the embedded LDK node — BUT the new 'Mortal' onboarding tier DEFAULTS new users to CUSTODIAL Cashu ecash (the mint holds funds) before graduating them to the self-custodial 'God' tier node", "license": "AGPL-3.0", "open_source": true, "status": "active", "status_note": "Graduated model: new users start CUSTODIAL (Cashu mint) then upgrade to self-custodial node. Sovereign only for own-node/God-tier users.", "best_for": "Power users who want a mobile remote-control head for their own Lightning node", "source_url": "https://bitcoinmagazine.com/business/how-zeus-is-redefining-bitcoin-with-cashu-ecash-integration", "confidence": "high", "sovereignty_score": 5 }, { "wallet_id": "samourai", "name": "Samourai Wallet (reference row — SEIZED, DO NOT FUND)", "developer": "Samourai Wallet LLC — founders Keonne Rodriguez & William Lonergan Hill arrested Apr 2024, pleaded guilty, sentenced Nov 2025 to 5 and 4 years", "platforms": "mobile (Android) — no longer distributed (removed from Play Store; infra/domain seized)", "node_connection": "own full node (Dojo) historically — but the project's coordinator/backend/domains were SEIZED, so live use is defunct", "node_sovereign_default": false, "custody": "self-custody", "watch_only": false, "descriptors": false, "psbt": false, "multisig": "no", "signer_interop": "n/a — hot wallet (BIP84 + BIP47 PayNyms); historical cold pairing via Sparrow/Passport (Sencha)", "coinjoin": "deprecated (Whirlpool) — coordinator SEIZED 24 Apr 2024; defunct. Root cause of Sparrow's removed Whirlpool client (v1.9.0). Revived separately by the Ashigaru fork.", "payjoin": true, "miniscript_timelock": false, "tor": true, "lightning": "no", "license": "Source-available (Unlicense-era)", "open_source": true, "status": "seized/defunct", "status_note": "SEIZED/DEFUNCT. Founders sentenced Nov 2025 (Rodriguez 5 yrs, Hill 4 yrs; $6.3M forfeited). Included only to explain why Whirlpool/Sparrow coinjoin died. Use the Ashigaru fork as the living successor.", "best_for": "Historical reference only — do not fund; explains why Whirlpool/Sparrow coinjoin no longer works", "source_url": "https://www.justice.gov/usao-sdny/pr/founders-samourai-wallet-cryptocurrency-mixing-service-sentenced-five-and-four-years", "confidence": "high", "sovereignty_score": 5 } ] }