Boltz Bridge

Non-custodial Lightning ↔ Onchain swaps. Routed to Electrum swap servers discovered via Nostr.

Reverse Submarine Swap — you send onchain, receive Lightning
sats
Minimum 20,000 sats. You PAY a Lightning invoice for this amount and receive slightly less onchain (service fee + miner fee).
A secp256k1 public key you control, from the wallet you will claim the onchain funds with. Generate creates a keypair entirely in your browser — the private key never leaves this page (shown once in Technical details; save the swap file to keep your claim rights).
Where the in-browser claim sends your onchain funds. Required for "Claim now".
Loading providers...
1 \u00b7 pay the Lightning invoice \u2192 2 \u00b7 provider broadcasts lockup \u2192 3 \u00b7 claim onchain (in this browser)

Experimental software — use small amounts first. Swaps are non-custodial; keep your swap file.

Swap Progress

reverse Reverse Submarine Swap

You want onchain sats but have Lightning liquidity. You generate a preimage, hash it, and give the hash to the provider along with a claim public key from your onchain wallet. The provider creates a Lightning invoice — you pay it — and then locks onchain funds in an HTLC spendable with your preimage + claim key (refundable to the provider after a timeout). You claim the onchain output with your wallet; the provider sees your preimage in the mempool and settles its side.

submarine Submarine Swap (two-phase)

You want Lightning but only have onchain sats. Phase 1 gives you a lockup address, an amount, and a preimageHash. You create a hold invoice in an electrum wallet keyed to that hash (phase 2). After you send the onchain amount and it confirms, the provider pays your hold invoice and claims the lockup by revealing the preimage onchain — your wallet then settles the held payment. If the provider never claims, your key refunds the funds after the timeout block.

simple Simple mode vs Trustless mode (Onchain → Lightning)

Simple — paste any invoice. You paste ANY Lightning invoice from ANY wallet and send onchain. That is the Boltz-style flow: Boltz itself takes the hash from your invoice, builds the lockup, pays your invoice, and claims. Our providers speak the newer Electrum protocol where the provider picks the hash and the invoice must match it — so in Simple mode the BRIDGE runs that hash-matched leg for you in its own wallet: it registers the swap-side invoice, and when the provider’s onchain claim reveals the preimage, the bridge settles its invoice and pays yours.

What Simple mode assumes: the bridge is honest. It sees your invoice (amount and payee), and after the provider claims it could in theory withhold your Lightning payment — detectable, because the provider’s claim is public onchain. What it can never do is steal your onchain coins: your refund key is generated in THIS browser, saved only to your swap file, and the lockup pays back to you alone after the timeout block (the “Refund now” button uses it). If the bridge disappears or turns malicious: worst case is a delayed or missing Lightning payment while your onchain funds sit safely in the HTLC until you refund them — never lost, only delayed.

Trustless — hold invoice. You create the hash-matched invoice yourself and the bridge only relays bytes; it learns nothing and nothing is trusted. The “hold” is not special magic: the payment hash is the contract. Any invoice keyed to the swap hash necessarily behaves as a hold invoice, because only the provider’s onchain claim can ever reveal the preimage your wallet would need to settle. The cost: you need tooling that can create an invoice for a hash you did not generate (Core Lightning’s hold plugin or Electrum’s add_hold_invoice — both shown in phase 2).

HTLC The redeemScript

Both swap types share the same Hashed Time-Lock Contract structure. It is a Bitcoin Script that releases funds conditionally — this is what makes the swap non-custodial and trust-minimized.

OP_SIZE 32 OP_EQUAL OP_IF OP_HASH160 <hash160(preimage)> OP_EQUALVERIFY <claimPubKey> OP_ELSE <timeoutBlockHeight> OP_CHECKLOCKTIMEVERIFY OP_DROP <refundPubKey> OP_ENDIF OP_CHECKSIG // claim branch: signer + 32-byte preimage hashing to hash160 // refund branch: signer only, after timeout block height

Nostr Electrum swap servers & discovery

Swap providers announce themselves on Nostr relays using NIP-33 parameterized-replaceable events of kind:30315. Each announcement carries an Electrum server endpoint, fee schedule, and a proof-of-work commitment. This Worker queries those relays on a schedule, filters by network (signet/mainnet) and minimum PoW, and caches the sorted list in Cloudflare KV.

Trust model

Non-custodial
Funds are locked in a Bitcoin Script the Worker cannot spend. Either you claim with the preimage, or the provider refunds after timeout. There is no third-party key.
Worker is a proxy
This Worker never holds private keys, never co-signs, and never sees your preimage. It forwards swap requests to the Electrum provider and remembers enough state to report progress.
Provider risk
The provider can refuse to settle the Lightning invoice, but cannot steal onchain funds — the refund path returns them to you after timeoutBlockHeight.
Verifiable scripts
Every swap returns its full redeemScript and timeoutBlockHeight. Decode them locally before sending funds.
Derives your xpub in-browser and looks up swaps created with it. Private keys never leave this page.

Experimental software. Use small amounts first. Swaps are non-custodial but the Worker itself is untested in production. No warranty; you assume all risk.