Bitcoin Privacy

Non-Custodial Lightning Wallets: Privacy Guide

A hand holds a dark-screen phone above grey felt, with a small networked computer farther behind.

A non-custodial Lightning wallet means you hold the keys, so no company can spend or freeze your bitcoin. Privacy is a separate question: who sees your payments depends on the setup you pick. With your own node and Zeus as the remote control, no single company sees all your payments; the routing nodes along the way see roughly how much passes through them. With Phoenix, ACINQ’s node routes your payments and sees the amount of each one and usually whom you pay.

This guide walks through the most sovereign setup, a Lightning node you run yourself: the node, your first channel, inbound liquidity so you can receive, and the backups that keep your money recoverable. It finishes with the mistakes that lose funds and answers to common questions.

Step-by-Step Guide

Step 1: Choose Your Node and Wallet Combination. Decide whether to run your own Lightning node or use a wallet that runs one on your phone. For maximum sovereignty, run LND or CLN (Core Lightning) on your own hardware, then connect Zeus as a mobile remote control. For a simpler approach, Phoenix runs a Lightning node on your phone and manages its channel for you; its channel partner is always ACINQ’s node, which sees the amount of every payment and usually whom you pay. Your choice sets the trade-off between control and convenience.

Three ways to hold Lightning bitcoin, each drawn as the path of a payment to a shop. Your own node, with Zeus as the remote control: the payment crosses several routing nodes, so no single company sees all your payments, though routing nodes see roughly what passes through them; you hold the keys, and your job is to run the node, back it up and keep it online. Phoenix, a Lightning node on your phone: every payment goes through ACINQ's node, so ACINQ sees the amount and usually whom you pay; you hold the keys as 12 words, and your job is to write them down and open the app now and then. A custodial wallet, a friendly app with the company's keys: the company sees every payment and holds the keys, so your job is to trust it with your bitcoin. More privacy takes more work.
The less you hand to a company, the more you run yourself. With your own node, no single company sees all your payments, but you run and back up the node. Phoenix keeps the keys with you and lets ACINQ see each payment. A custodial wallet holds the keys and sees everything.

Step 2: Install and Sync Your Bitcoin Full Node. This setup runs your Lightning node on your own Bitcoin full node, which checks every block itself (LND can also run as a Neutrino light client, which relies on other nodes and does not check every block). Install Bitcoin Core on dedicated hardware—a Raspberry Pi 5 or a mini-PC with a 2 TB SSD, or a plug-and-play node solution like Umbrel or Start9. A 1 TB drive is nearly full on day one: Bitcoin Core 32.1 needs about 900 GB, and the chain grows about 80 GB a year. Wait for the initial block download to complete (two to four days on a Raspberry Pi 5, one to three on a mini-PC). Your Lightning node cannot operate until the Bitcoin node is fully synchronized.

Step 3: Install and Configure Your Lightning Implementation. Install LND or CLN on the same machine as your Bitcoin node. Configure it to connect to your local Bitcoin Core instance. Set up a strong wallet password and write down the seed: LND gives you 24 words in its own format (aezeed), which restore into LND and not into an ordinary wallet, so label them as an LND seed; on CLN the seed lives in hsm_secret. The seed recovers your on-chain funds but not the money in your channels—for that you need the static channel backup, covered in the next step: channel.backup on LND, emergency.recover on CLN.

Step 4: Back Up channel.backup, and Never Restore channel.db. LND keeps the Static Channel Backup in a file called channel.backup and rewrites it each time a channel opens or closes. Copy it off the node after every channel you open or close, or automate the copy: it is encrypted with a key from your seed, so it is safe on a USB stick or in cloud storage. If your node dies, a new node restored from your seed reads this file and asks each peer to force-close its channel; as each closing transaction confirms, your settled balance comes back on-chain. Never restore an old copy of channel.db, LND’s live channel database, or start a node on one: it holds out-of-date balances, and publishing one lets your peer take everything in the channel. A copy kept aside is not a backup, though a specialist tool such as chantools can extract a fresh channel.backup from it. On CLN the static backup is emergency.recover, in the node’s data directory; CLN updates it whenever a channel opens, so copy it off the node after each new channel, and don’t restore an old snapshot of CLN’s database either. Our lesson on Lightning backups and watchtowers explains each file.

Three things on or from your LND node. Your 24 words, copied once on paper or metal, bring back your on-chain funds and are the key that unlocks channel.backup. The file channel.backup, copied after every channel you open or close and safe on a USB stick or in cloud storage because it is encrypted, brings back the money in your channels, as each peer closes its channel. The file channel.db, LND's live database, is never a backup and an old copy is never restored: restoring one makes your node publish an old balance, and your peer can take the whole channel.
Copy channel.backup; never restore channel.db. The words bring back your on-chain funds and unlock the backup file; the backup file brings back the money in your channels. The live database is not a backup: restoring an old copy is how a node publishes an out-of-date balance.

Step 5: Open Your First Payment Channel. Pick a well-connected peer that is online all the time; explorers such as Amboss and LightningNetwork+ show each node’s channels and history. Use lncli openchannel or your node’s GUI to open a channel with a capacity that fits your expected payments—typically 500,000 to 2,000,000 satoshis for personal use. The channel becomes usable once the funding transaction has a few confirmations: LND asks for 3 to 6, depending on the channel’s size.

Step 6: Obtain Inbound Liquidity. A new channel only provides outbound capacity (your ability to send). To receive Lightning payments, you need inbound liquidity—balance on the remote side of your channels. Options include: spending through your channels so part of the balance moves to the other side, asking another node to open a channel to you, buying an inbound channel from a Lightning Service Provider, or swapping part of your balance out on-chain with Loop Out. Without inbound liquidity, you cannot receive payments.

A Lightning channel is one pot split between your side, which you can send from, and the other side, which lets you receive. Example amounts: you open a 1,000,000-sat channel, all of it on your side, so you can send 1,000,000 and receive nothing yet. Three moves change that. 1: you spend 400,000 at a shop; those sats move to the other side, so you can send 600,000 and receive 400,000. 2: you Loop Out 400,000: you pay a swap service over Lightning and it sends the sats back to you on-chain, minus fees, which leaves the same 600,000 and 400,000 split while you keep the money. 3: another node opens a second channel to you, funded by them, which you can ask for or buy from a Lightning Service Provider (LSP); you can receive up to its full size.
To receive, balance has to sit on the other side of a channel. Your own channel starts entirely on your side. Spending moves sats across; a Loop Out does the same and sends the money back to you on-chain; a channel opened to you, asked for or bought from a Lightning Service Provider, starts on their side. Example amounts.

Step 7: Connect Your Mobile Wallet to Your Node. Install Zeus, which works with LND and CLN, on your phone, and choose to connect a remote node. Node platforms give you the connection details as a QR code: in Umbrel’s Lightning Node app, open the three-dot menu and choose Connect wallet, which connects over Tor by default. Treat that QR code like a key: it carries full admin access, so whoever scans it can spend your node’s funds. Don’t screenshot it or share it. Once connected, your mobile wallet controls your self-hosted Lightning node, letting you send and receive payments from anywhere while maintaining full custody.

Common Mistakes to Avoid

1. Choosing a Custodial Wallet While Believing It Is Non-Custodial. Some wallets market themselves as non-custodial but hold your keys on their servers or use custodial Lightning service providers behind the scenes. Verify by checking: can you export your seed phrase? Does the wallet connect to your own node or a third party’s? Can you access your funds if the wallet company disappears? Alby’s shared wallet was custodial behind a friendly interface until Alby closed it on 4 January 2025. Wallet of Satoshi, long the best-known custodial example, now offers a self-custody mode built on Spark with a 12-word recovery phrase. The company calls it self-custodial; WalletScrutiny, an independent wallet reviewer, still rates it custodial, because Spark’s operators must co-sign every transfer. Keep only small amounts in it.

2. Opening Channels with Insufficient Capacity. Channels smaller than 200,000 satoshis are impractical—they cannot route most payments, incur proportionally high on-chain fees for opening and closing, and may be force-closed by peers who consider them uneconomical. Open fewer channels with larger capacity rather than many small channels. A single 2,000,000-satoshi channel with a well-connected node serves most personal payment needs.

3. Neglecting Channel Backups. A dead drive with no current channel backup (channel.backup on LND, emergency.recover on CLN) is a classic way to lose Lightning funds. Unlike on-chain Bitcoin, the latest channel balance is not stored on the blockchain—it exists only on your node and your peer’s node. On LND, copy a fresh channel.backup off the node after every channel you open or close, and check a copy with lncli verifychanbackup --multi_file=/path/to/channel.backup; on CLN, copy emergency.recover after every channel you open. Do not “back up” channel.db instead: restoring an old copy is how a node ends up publishing an out-of-date balance and losing the channel.

4. Running a Lightning Node on Unreliable Hardware. Lightning nodes must be online to route payments and monitor channel states. If your node goes offline for extended periods, channel partners may force-close your channels, which ends them and costs on-chain fees. The bigger risk is a peer publishing an old balance while you are away: someone has to answer it within the waiting period your node set, about a day (144 blocks) on small LND channels. Run a watchtower from your first channel if your node will be off for longer. Use hardware with reliable power (consider a UPS), stable internet, and sufficient storage for the growing blockchain.

5. Exposing Node APIs Without Proper Authentication. Your Lightning node’s API allows full control of your funds—opening channels, sending payments, and sweeping balances. Exposing this API to the internet without Tor, TLS encryption, and macaroon-based authentication allows anyone who discovers it to drain your channels. Always access your node through Tor hidden services and never share your admin macaroon.

Frequently Asked Questions

Can I recover my Lightning funds if my node crashes?

Yes, for the channels in your latest channel.backup. Restore your LND wallet from its 24 words and give it the file. Your node contacts each peer, and the peer force-closes the channel with its latest balance; once that transaction confirms, your share can be spent within a block, because the long wait falls on the side that closed. Your node then sweeps it into your on-chain wallet with a transaction of its own, which LND treats as low priority (by default it aims to confirm it within about a week), so when fees are high it can take days. The channels themselves end, payments in flight at the moment of failure are lost, and each peer has to be online to close. If a peer never comes back, backups from LND 0.19 on carry a last-resort close, but if the channel has changed since that backup, publishing it can hand the peer the whole channel, so consult a recovery specialist first. Channels opened after your last copy are not in the file: that money depends on the peer closing on its own, and collecting it can take a specialist tool such as chantools. Never restore an old channel.db to get around this.

Four steps after your node dies. 1: the drive fails or the machine is lost. 2: you restore on a new LND with your 24 words and your latest channel.backup. 3: each peer, if it is online, force-closes its channel with its latest balance. 4: one block after the closing transaction confirms, your share is spendable on-chain. Why your share comes back first: the peer's closing transaction pays out the latest balance in two parts; yours is spendable one block after it confirms, while the peer's share waits out its delay, because the side that closed is the one that waits. The file cannot save three things: the channels themselves end, payments that were mid-way at the moment of failure, and channels opened after your last copy, which are not in the file. The backup recovers your money, not your channels.
The backup brings your money back, not your channels. Restore with your 24 words and your newest channel.backup, and each online peer closes its channel; the peer, as the closer, waits, and your share is yours a block later. A channel opened after your last copy depends on its peer closing on its own, and may need a specialist tool such as chantools.

How much does it cost to run a self-custodial Lightning node?

Hardware came to about $150–$370 when we last priced it: a Raspberry Pi with a 2 TB SSD at the low end, a mini-PC with a 2 TB NVMe drive at the top. Check current prices. Electricity usage is 5-15 watts, adding $1-3/month to your power bill. The Bitcoin node underneath downloads about 20 GB a month and can upload 200 GB or more if it shares blocks with others (you can limit that, though not to a hard cap); Lightning adds little on top. On-chain fees depend on how busy the network is: as of November 2026, 1 to 3 sat/vB is usually enough, and at 1 sat/vB opening a channel costs about 150 sats and a cooperative close about 190; at 300 sat/vB, as in December 2023, each step costs tens of thousands of sats. Total first-year cost is approximately $150-400 including hardware.

Is Phoenix Wallet truly non-custodial if ACINQ manages the channels?

Yes. Phoenix runs a real Lightning node on your phone with your private keys stored locally. ACINQ serves as your channel counterparty (like any Lightning peer) but cannot spend or freeze your funds. If ACINQ’s node disappeared, you could force-close your channel from the app (Settings, then Danger zone); after about 720 blocks, roughly five days, the funds come back on-chain. Keep the app installed until they do. If you lose your phone, your 12 words restore the wallet on a new one, because ACINQ’s node keeps an encrypted copy of your channel data and returns it. The trade-off is privacy: ACINQ finds the route for your payments, so it sees the amount of every payment and usually whom you pay; only paying a BOLT 12 offer from someone not on Phoenix can hide who you paid.

Why do some merchants not accept Lightning payments from self-custodial wallets?

This is typically a routing issue, not a wallet discrimination issue. Self-custodial wallets must find a payment route from your node through the Lightning network to the merchant’s node. If your node has limited connectivity (few channels, poorly connected peers), route-finding may fail for some payments. Improving your node’s connectivity by opening channels to major routing nodes and ensuring adequate outbound liquidity resolves most payment failures.

Related Resources

Part of our free Bitcoin course: This topic is covered in Lightning Wallets Compared: Phoenix, Zeus, Fedimint and More, from the Lightning Network & Bitcoin Nodes course.
Filed under: Bitcoin Privacy
← Back to All Articles