Wallet of Satoshi against Phoenix: what "self-custody" is doing in that sentence

This review opens with a word, because the word is the product. Wallet of Satoshi is retiring the custodial wallet that made its name, pointing users at a replacement it calls self-custodial. Phoenix, from ACINQ, answers the same question the old way: twelve words, written down, and if you lose them the money is gone. Both put Lightning on a phone. Neither asks you to trust the same people.

The file on each

What the vendors' own documents say

WoS — modes	Both offered: self-custodial everywhere, custodial in supported regions only
WoS — what powers self-custody	Spark, per the company's Disclosure Document v1.23 of 25 August 2026: a third-party Layer 2 from LightSpark
Spark — trust assumption	1-of-n: funds stay safe while one Signing Operator is honest, per Spark
Spark — operator set	Three, per Spark's docs FAQ: Lightspark, Flashnet, Breez
Phoenix — custody	One 12-word recovery phrase; per ACINQ, lose it and your funds are lost

First, correct the framing

Wallet of Satoshi has not gone self-custody. Its homepage, as of this writing, still advertises both modes: custodial, where the company holds the keys on your behalf, and self-custodial, where you hold them. What is winding down is the legacy custodial wallet, region by region.

Reporting dated 13 August 2026 says legacy invoice issuance had already stopped in the US, EU, Australia and New Zealand, with remaining regions to follow by the end of September and a 30 June 2027 cut-off to move balances. Those dates come from press coverage. We read the company’s support index and its 25 August 2026 disclosure document on 3 September and found neither date in either — a fact about those two documents, not proof it is unsaid elsewhere. Treat them as a reason to act early, not a contract.

What the replacement actually is

That disclosure document is the useful text. It says that under self-custody Wallet of Satoshi does not hold, access or have the ability to recover your keys. It also names the machinery: Spark, the LightSpark-developed Layer 2 that underpins the self-custody functionality, alongside Flashnet for routing, swaps and settlement, with the company disclaiming responsibility for those third parties’ actions, omissions or modifications, which it says can affect whether the features work.

Both sentences hold at once, and that is the trap. Wallet of Satoshi, per its disclosure, does not hold your key. Somebody else holds a share of one.

The trust that remains

Spark describes a 1-of-n operator model: a Signing Operator co-signs with you, neither side can move funds alone, and the arrangement holds while one operator stays honest. That page still says two operators; Spark’s docs FAQ now names three, adding Breez. Security depends on that operator destroying its old key share after each transfer — and Spark states plainly that operators cannot cryptographically prove key deletion. Its own layer-two comparison goes further: Lightning is fully trustless, with no federation, no operator and no third-party key holders, while Spark trades full trustlessness for usability.

Independent readings agree. Bitcoin Magazine’s October 2025 piece by Seth For Privacy prefers trust-minimized to trustless, and gives the failure case: if every operator refused to delete its key share and colluded with a previous sender, a leaf could be double-spent. Unanimous collusion is a high bar carrying reputational cost. It is not zero, and zero is what self-custody promises. On the July 2025 announcement, developer Matt Corallo said the label fully trusts the operator not to steal; Spark’s CTO Kevin Hurley answered that operators delete keys once transfers complete.

Phoenix’s answer

Phoenix does not have this problem, and pays for the privilege. ACINQ’s repository states the wallet is self-custodial, that a 12-word phrase is generated at setup, that only you have it, and that losing it loses your funds. No operator’s good behaviour to rely on, no deletion promise to audit. And Phoenix keeps a real Lightning channel per user — ACINQ’s splicing write-up describes one channel, one UTXO each — which costs on-chain fees to fund and resize.

The short version

Pros

The self-custodial mode is offered everywhere, per the company's site, where custodial is regional
Spark removes channel management outright, and ships pre-signed exit transactions that reach Bitcoin L1 without operator permission
Phoenix's trust model is twelve words and nothing else, per ACINQ: no operator, no deletion promise
Phoenix is listed on the US App Store under ACINQ, so American readers have the option

Cons

Spark's security rests on operators destroying old key shares, and Spark's own page says they cannot prove it
Three named operator firms, and the published failure case needs all three colluding with a previous sender — a high bar, but a nameable one
Spark's own comparison ranks Lightning above it on security; the vendor claims no parity
Spark concedes a small balance can cost more in fees to exit to L1 than it is worth — the hatch is thinnest for the smallest users
Phoenix punishes one mistake absolutely: lose the twelve words and, per ACINQ, the funds are gone
Phoenix's channel is real, so funding and resizing it costs on-chain fees Spark largely sidesteps

Verdict

If the amount is small and the point is spending — coffee, tips, a Lightning address — the Spark-based wallet is a reasonable home, provided you read the word as trust-minimized rather than trustless. If the balance is one you would grieve, Phoenix is the stronger answer, and the rival vendor says as much.

The briefing does not change with the app. The recovery phrase goes on paper or metal, offline: never typed into a keyboard, never photographed, never stored in a cloud, never given to support. Moving a custodial balance, send a test amount first. Set it against where your seed comes from on a hardware device, because the same phrase governs both. Crypto assets are high risk, and self-custody moves that risk onto your desk — so read the disclosure and Spark’s research pages yourself, then pick the failure mode you can live with.