Boltz, the non-custodial bridge that routes swaps between bitcoin’s mainchain, the Lightning Network and Liquid, disabled its service indefinitely on Monday, saying months of automated, AI-assisted attacks on its infrastructure have outpaced its ability to ship fixes.
Boltz first took its swap services offline at 5:54 am ET on Aug. 3 without explanation. In a follow-up statement about six hours later, the team said the suspension will last “until further notice” and described a months-long pattern of intrusions.
“Over the past months we have seen a steady rise in automated, AI-assisted probing of our infrastructure, and we have dealt with several exploits,” the team wrote. “Each was contained, but the pattern is clear: attackers now iterate faster than a team our size can find and patch.”
The shutdown cuts off the swap rails behind Lightning and Liquid payments in wallets such as Bull Bitcoin and Aqua, and it attaches a name to a fear that has been building among open-source developers: small teams defending public codebases against attackers armed with AI tooling.
The team said the pressure intensified in recent days as it found itself “actively targeted by what appear to be multiple resourceful groups,” and that after reviewing its own security scans it “cannot responsibly re-enable Boltz swaps.”
“What we are seeing is a major paradigm shift for Bitcoin services operating on an open source stack, and it needs careful analysis,” the statement said. “Do not expect swap services to resume shortly.”
‘The Losses Were Ours Alone’
Boltz said the exploits it contained cost the company money but never put user funds in danger, since its atomic swap design leaves users in control of their coins throughout a swap.
“To be explicit: no user funds were ever at risk. Boltz is non-custodial by design. And as a fully bootstrapped company, the losses were ours alone,” the team wrote.
The Boltz API remains online to process refunds for in-flight swaps cooperatively, and the team noted that unilateral refunds work without its infrastructure.
The disclosure recasts an Aug. 1 notice in which Boltz disabled its EVM swaps — USDT, USDC, TBTC, WBTC and RBTC — citing “a bug in our EVM integration” while assuring users that Lightning, Liquid and onchain $BTC swaps were running normally.
Boltz launched in April 2019 and grew into becoming the default swap plumbing across bitcoin’s layers, adding Rootstock, chain swaps between Liquid and the mainchain, a BTCPay Server plugin, and stablecoin swaps on Tron, Solana and EVM chains.
Wallets Scramble for Rails
Wallets that lean on Boltz as a backend moved within hours. Francis Pouliot, CEO of Bull Bitcoin, said the company is “immediately shifting our priorities” to restore Lightning payments and Liquid-to-bitcoin swaps for its wallet users, warning that until then those functions will fail without explanation. Because Bull Bitcoin is a member of the Liquid federation, he said, no user funds will be stuck on Liquid.
“I will not let this situation linger. I will fix it, no matter what it takes,” Pouliot wrote.
Samson Mow, CEO of JAN3, the firm behind the Aqua wallet, said restoring Liquid and Lightning swaps is the team’s top priority and that Aqua has “offered to help Boltz address issues in their infrastructure.” User funds on Aqua remain safe and under user control, he said.
Lightning wallet ZEUS, which runs its own instance of Boltz’s open-source stack, took it offline as well. “We’re following suit with our instance at swaps.zeuslsp.com,” the team wrote.
Bitcoin educator $BTC Sessions summed up the immediate damage: wallets using Boltz for Lightning swaps “will not function as expected now,” while Liquid transactions themselves keep working.
‘The Token War’
The suspension lands in the middle of the worst week for bitcoin security in years. An exploit of Coldcard hardware wallets, traced to a 2021 firmware bug that made seed phrases guessable, has drained roughly $114 million in $BTC since July 30, with a fourth wave of thefts hitting Monday.
Pouliot drew the line between the two events directly: “First, the Coldcard exploit. Now, a critical piece of Lightning infrastructure goes offline. We are undoubtedly on the losing end of the Token War.”
Lucas Ferreira, executive director of bitcoin research and development nonprofit Vinteum, said the episode shows the resource gap facing bitcoin’s infrastructure builders. “Boltz has a brilliant team, but it’s a small team facing increasingly sophisticated, AI-powered groups of hackers,” he wrote. “We’ll need more funding for the open-source space if we want our infrastructure to remain secure and resilient.”
