How does the self-custody wallet work?

When we set out to build a self-custodial Lightning wallet, we faced a fundamental challenge that every Lightning wallet developer is familiar with. Traditional Lightning wallets require users to manage channels, maintain inbound liquidity, and handle on-chain transactions that can cost $10-50 during high-fee environments. For a spending wallet meant for daily transactions, these pain points make the experience unbearable.
​

We chose to build on Liquid, Bitcoin's longest-running sidechain, as our settlement layer. This decision wasn't made lightly - we evaluated every available option and concluded that Liquid provided the best foundation for what our users actually need: a Lightning wallet that just works.

When you receive funds in your Bringin Lightning wallet, they're stored as L-BTC (Liquid Bitcoin) on the Liquid sidechain. Let me explain what this means in practice.

The Liquid Network is a federated sidechain of Bitcoin, operated by a consortium of 15 major Bitcoin companies including Blockstream, Bitfinex, and others. When BTC is pegged into Liquid, it becomes L-BTC - a token that maintains a 1:1 peg with Bitcoin. This isn't a ‘synthetic asset’ or a ‘wrapped token’; it is BTC that has moved to a parallel chain with different properties, whose value is mathematically backed by Bitcoin held in custody by the consortium.
​

Your wallet generates a standard BIP39 mnemonic phrase - those 12 words represent your private keys. These keys control your L-BTC on the Liquid sidechain, just as a Bitcoin wallet's keys control BTC on the main chain. The crucial point here is that you, and only you, have access to these keys. Bringin never sees them, stores them, or has any ability to access your funds.

The magic that makes our Lightning wallet feel seamless happens through submarine swaps, specifically using the Boltz Exchange. Let me walk you through what happens when you receive a Lightning payment.

Submarine swaps are trust-minimized atomic swaps of off-chain BTC (in this case, BTC on Lightning) for on-chain BTC and vice versa. A payment secured by a Hash Time-Locked Contract (HTLC) is routed over the Lightning Network (LN) to a service provider who creates an on-chain output paying the same HTLC. The on-chain receiver can settle the HTLC to claim its funds, allowing the LN HTLCs to be settled like normal. Now let’s see how this works in Bringin.

The service provider we use for making these swaps is Boltz, an instant, account free, and non-custodial service built on top of the lightning network. The service operates without collecting user data or requiring identity verification, making it compatible with the privacy and sovereignty principles underlying self-custodial Bitcoin.

When someone sends sats to your Bringin wallet via the Lightning network, the payment goes to Boltz first. Boltz simultaneously creates two linked transactions - Lightning transaction receiving the payment and a Liquid transaction sending L-BTC to your wallet.

These transactions are atomically linked through HTLCs, meaning either both complete successfully or both fail - there's no scenario where funds get stuck

To achieve these trustless properties, the on-chain transaction makes use of the same HTLCs as the Lightning Network. Before on-chain BTC are transferred, the recipient of the Lightning transaction generates a preimage, a random 32-byte secret. This preimage is hashed and used to construct the HTLCs for both on- and off-chain payments.

From your perspective, you simply see an incoming Lightning payment. Behind the scenes, the Lightning payment has been converted to L-BTC and deposited in your Liquid wallet. The entire process typically takes just a few seconds.

The same process works in reverse for sending payments. When you scan a Lightning invoice, your wallet creates a Liquid transaction sending L-BTC to Boltz, which then completes the Lightning payment to the final recipient. Again, this is atomic and trustless - Boltz cannot steal funds because the protocol ensures they only receive the L-BTC if they successfully complete the Lightning payment.

Conversely, when you scan a Lightning invoice to send a payment, your wallet creates a Liquid transaction sending L-BTC to Boltz. Boltz completes the Lightning payment to the final recipient on your behalf. This is atomic and trustless - Boltz cannot steal funds because the protocol ensures they only receive the L-BTC if they successfully complete the Lightning payment.

We leverage the Breez SDK for Lightning functionality, which provides a complete Lightning node implementation that runs on your mobile device. The Breez SDK is a great solution for developers looking to integrate self-custodial Lightning into their apps and services, removing third-party dependencies.

However, unlike traditional mobile Lightning wallets, we don't actually maintain Lightning channels or deal with channel states. Instead, the Breez SDK interfaces with our submarine swap system to provide the Lightning experience without the Lightning complexity.

The Liquid blockchain processes blocks every minute, compared to Bitcoin's 10-minute average. This faster block time means swap confirmations happen quickly, making the Lightning experience feel instant. Liquid also uses Confidential Transactions, which hide transaction amounts from public view - a privacy feature that Bitcoin's base layer doesn't offer.

For developers interested in the specific implementation, we use standard Liquid addresses derived from the path m/84'/1776'/0'/0/0. The wallet interfaces with Liquid through Blockstream's Electrum servers, ensuring reliable access without running a full node on the mobile device.
​

It's important to understand exactly what trust assumptions you're making when using our wallet. With Liquid being a federated sidechain, you're trusting that a majority of the federation members (11 out of 15) won't collude to steal funds or censor transactions. This is different from Bitcoin's trustless model but significantly better than trusting a single custodial service.
​

The federation members are established companies with significant reputations at stake. They include exchanges, wallet providers, and infrastructure companies distributed globally. The system has operated without incident since 2018, processing billions of dollars in value.
​

Additionally, Liquid has emergency recovery mechanisms. If the federation ever became unresponsive, time-locked backup keys would eventually allow fund recovery. While this has never been needed, it provides an important safety net.

You can always verify your funds independently by importing your seed phrase into any Liquid-compatible wallet like Green or Aqua. Every transaction is recorded on the Liquid blockchain and can be viewed using block explorers. If you ever want to move your L-BTC back to mainchain Bitcoin, you can perform a peg-out operation, though this requires interacting with federation members.
​

Our implementation provides significant privacy benefits compared to both mainchain Bitcoin and custodial Lightning wallets. Liquid's Confidential Transactions hide transaction amounts, making it impossible for outside observers to see how much you're sending or receiving. The asset type is also blinded, though in our case we're only dealing with L-BTC.
​

However, transaction metadata - such as when transactions occur and which addresses are involved - remains visible on the blockchain. While addresses are pseudonymous, they can potentially be linked through chain analysis. This is still far superior to custodial solutions where the service provider sees every detail of every transaction.
​

From Bringin's perspective, we cannot see your transaction history, balances, or payment destinations. When you make a Lightning payment, we don't know who you're paying or how much. This privacy is built into the architecture - it's not a policy decision we could change even if we wanted to.
​

We view our current Liquid-based architecture as the best available solution today, not the final destination. The Lightning ecosystem is evolving rapidly, with new protocols and technologies emerging that could provide better trade-offs between sovereignty, privacy, and usability.
​

We're closely following developments in several areas. The Ark protocol promises to enable Lightning-like payments with better privacy and less interaction required. Statechains and similar constructs could reduce trust requirements while maintaining usability. Improvements to Lightning itself, such as better pathfinding algorithms and channel management automation, might eventually make native Lightning practical for average users.
​

Our architecture is designed to be adaptable. The core user experience - scanning invoices, sending and receiving Lightning payments - remains constant regardless of the underlying technology. When better solutions become production-ready and battle-tested, we can migrate without disrupting the user experience.
​

This flexibility is intentional. We're not ideologically wedded to any particular technical approach. Our commitment is to provide the best possible self-custodial Lightning experience, using whatever tools help us achieve that goal.

Bitcoin Standards & Specifications:

Liquid Network

Submarine Swaps & Atomic Swaps

Breez SDK