Submarine Swap

A submarine swap is a trustless exchange between on-chain bitcoin and off-chain Lightning balance. It is a specific kind of atomic swap that bridges the two layers without custody or counterparty risk: the on-chain leg and the Lightning leg are made conditional on the same secret, so they either both execute or neither does. No one — not the swap provider, not the user — can end up holding both sides.

How it works

The mechanism reuses the hashlock construction that secures ordinary Lightning payments. The two parties agree on a payment hash; the on-chain leg is locked in an HTLC-style contract that pays out only to whoever reveals the preimage, and the Lightning leg is locked to the identical hash. Claiming one leg necessarily reveals the preimage, which immediately unlocks the other leg for the counterparty — the atomicity is enforced by the mathematics, not by reputation. If the swap stalls, timelocks unwind it: after expiry, the funder reclaims their coins and both sides walk away whole. The cost of that safety is patience — the on-chain leg lives on mempool time and pays on-chain fees, so a swap is slower and costlier than a pure Lightning payment, and providers charge a fee for the service and the liquidity they commit.

Why node operators use them

Submarine swaps are first-line tools for liquidity management. A loop out (reverse swap) sends Lightning balance away and receives on-chain bitcoin, draining your local balance — which simultaneously creates receive-side room in your channels. A merchant whose channels fill up with incoming payments loops out periodically, converting Lightning revenue into on-chain UTXOs for cold storage while refreshing capacity to get paid again. A loop in does the reverse, refilling depleted sending capacity from an on-chain UTXO. The strategic value is that swaps rebalance across layers without closing anything: channel opens and closes cost fees and downtime, while a swap adjusts where your balance sits inside existing channel capacity. They are also how a fresh wallet tops up Lightning from on-chain funds, or cashes out to chain, without channel surgery.

The sovereignty angle

What makes submarine swaps worth understanding — rather than just clicking a "loop out" button — is the trust model. The swap provider is a counterparty you need for liquidity, not a custodian you must believe: at no point can they abscond with funds, because every path either completes atomically or refunds on timeout. That is a categorically better arrangement than an exchange account bridging your on-chain and Lightning worlds. For an operator running their own node, swaps pair naturally with acquiring inbound liquidity and with routine treasury hygiene: earn on Lightning, loop out to cold storage, keep channels balanced — all without handing coins to anyone. The fee you pay a swap service buys coordination, never custody, and that distinction is the whole point.

Costs, timing, and privacy notes

Budget a swap across three components: the provider's service fee (typically a small percentage plus fixed overhead), the on-chain miner fee for the settlement leg, and Lightning routing fees for the off-chain leg. Timing follows the chain: a loop out is not final until the on-chain transaction confirms, so fee spikes both raise costs and stretch settlement, and quotes worth taking state their confirmation assumptions plainly. The refund path deserves respect too — a failed swap returns funds only after the timelock expires, so capital can sit locked for hours; never swap coins you need before the timeout clears. On privacy: the provider necessarily learns the pairing between your Lightning node and the on-chain addresses in the swap, which is a real metadata trail even though funds were never at risk. Spreading swaps across providers and being deliberate about address reuse keeps that trail from becoming a ledger of your treasury operations.