How it works
Phoenix is built on lightning-kmp, ACINQ's Kotlin Multiplatform port of its Eclair node. Each install boots a real Lightning node that lives on the device and is unlocked by a 12-word BIP-39 seed the user keeps. Funds are protected by a single dynamic Lightning channel opened to ACINQ; the wallet then uses splicing — a protocol upgrade ACINQ helped land — to grow or shrink that channel on-chain without a close-and-reopen. Sends go out through trampoline payments and, more recently, BOLT12 reusable offers; receives use ACINQ's pay-to-open flow, which converts an incoming on-chain payment into Lightning capacity. Phoenix is mobile-only — Android and iOS — and ships as ACINQ/phoenix on GitHub under the Apache 2.0 licence. A separate, headless variant called phoenixd targets self-hosters.
KYC & privacy
No account, no email, no phone, no ID. Installing the app is the whole onboarding. The privacy story is more nuanced than the install story. Because the wallet always opens its channel to ACINQ, ACINQ acts as the user's only direct Lightning peer and sees the metadata of every payment that leaves the device: amount, timing, and — in practice — destination, because most of Phoenix's routes are short. Receives reveal the same to the LSP. ACINQ publishes no formal no-logs claim, and Tor is not built in. On 3 May 2024 ACINQ pulled Phoenix from US app stores, citing FinCEN's intensifying treatment of self-custodial and LSP software as money-services activity; existing US installs were instructed to drain on-chain.
Strengths and limits
Phoenix's strength is structural: it is one of very few mobile wallets where the user holds the keys to a real Lightning node, not a custodial balance dressed up as one. Splicing makes on-chain liquidity management feel ordinary — moving sats in or out no longer requires a channel close. The seed backup is plain BIP-39, recoverable on phoenixd if the mobile project ever goes dark. The limits are the price of that UX. ACINQ's LSP role concentrates routing visibility on a single party, which Wasabi-grade privacy purists rightly flag. The wallet's mempool exposure during channel splices can also leak rough activity timing to chain watchers. And US users are now locked out at the app-store layer, with sideloading the only escape on Android.
Verdict
Phoenix is the cleanest self-custodial Lightning UX on a phone, shipped by the team that wrote one of the protocol's reference implementations. Its weakness is not custody but visibility: the convenience comes from routing through ACINQ, and ACINQ sees what flows. Use it for spending Lightning sats privately from the chain, not for hiding payment graphs from a determined peer. Grade: A- (8.9/10). Trust: TRUSTED.
Phoenix is the cleanest self-custodial Lightning UX on a phone, but ACINQ's LSP role concentrates routing visibility on a single peer. Use it for holding and spending your own sats; pair it with mixing or atomic-swap layers if you need to hide payment graphs. Grade: A- (8.9/10). Trust: TRUSTED.
