Is there a "kill switch" in Spark's operator code that freezes individual wallets?

Yes. Lines 59–64 are a kill switch for one wallet at a time, and it covers bitcoin, not just tokens. The answer above couldn't open the file. Here is what it says at that commit:

// KnobKillSwitchWallet blocks state-mutating user-facing operations for a
// specific wallet identity public key. Set
// spark.so.killswitch.wallet@<identity_pubkey_hex> = 1 to freeze that wallet.
// Default 0 (allowed). The check is per-SO; for a system-wide freeze set
// this on every SO's knob ConfigMap. Read-only RPCs are unaffected.
KnobKillSwitchWallet = "spark.so.killswitch.wallet"

What the code around it does:

• It's enforced, not just defined. spark/so/authz/killswitch.go checks the flag, and on Spark's main branch 23 handler files call that check. They cover sending and claiming transfers, Lightning, deposits, cooperative exits, leaf renewals, swaps and token transactions. Read-only calls aren't checked, so a frozen wallet can still see its balance. It just can't move it through Spark.
• It's flipped at run time. It's a config value an operator sets, with no code change or redeploy.
• The wallet isn't told it's frozen. The check returns the same error as an ordinary identity mismatch, "so probing callers cannot distinguish a kill switch from any other permission failure" (the code's own comment).
• It's per operator. Each operator checks its own setting, and a network-wide freeze means setting it on every operator. Spark has only a handful of operators.
• It was added on 2026-05-28 (#7360, "Add wallet kill switch for state-mutating RPCs").

What it can't do is take the money. A Spark wallet holds pre-signed exit transactions, so a frozen wallet can still leave for Bitcoin on its own, with no operator involved (withdrawals). That route is slow because of timelocks, it costs on-chain fees that can swallow a small balance, it needs a wallet that kept those transactions, and Spark still calls it beta.

So: Spark's operators can't steal your bitcoin, but they can quietly stop any one wallet from using Spark, at any time. That fits Spark's own trust model, which promises operators can't steal, not that they can't censor. It's still worth knowing the switch exists and works one wallet at a time.