Boltz, the non-custodial bridge that routes swaps between Bitcoin’s main chain, the Lightning Network, and Liquid, has suspended its swap service indefinitely, saying months of automated, AI-assisted attacks on its infrastructure have outpaced its ability to patch issues safely.
The service first went offline at 5:54 a.m. ET on Aug. 3 without explanation. About six hours later, the team said the shutdown would remain in place “until further notice” and described a months-long pattern of intrusions.
In its statement, Boltz said it had seen a steady rise in automated, AI-assisted probing of its infrastructure over recent months and had already dealt with several exploits. Those incidents were contained, the team said, but the broader trend had become hard to ignore. Attackers were now iterating faster than a team of Boltz’s size could identify and fix vulnerabilities.
The suspension cuts off the swap rails used behind Lightning and Liquid payments in wallets such as Bull Bitcoin and Aqua. It also puts a name to a concern that has been building among open-source developers: small teams maintaining public codebases are increasingly facing attackers equipped with AI tooling.
Boltz said pressure increased in recent days as it found itself “actively targeted by what appear to be multiple resourceful groups.” After reviewing its own security scans, the team said it “cannot responsibly re-enable Boltz swaps.”
The statement framed the issue as larger than one service outage. “What we are seeing is a major paradigm shift for Bitcoin services operating on an open source stack, and it needs careful analysis,” the team wrote. “Do not expect swap services to resume shortly.”
Boltz says users were not exposed to losses
Boltz said the exploits it managed to contain cost the company money, but did not place user funds at risk. The team pointed to its atomic swap design, which keeps users in control of their coins throughout the swap process.
“To be explicit: no user funds were ever at risk. Boltz is non-custodial by design. And as a fully bootstrapped company, the losses were ours alone,” the team wrote.
The Boltz API remains online to process cooperative refunds for in-flight swaps. The team also said unilateral refunds can still be completed without relying on Boltz infrastructure.
The disclosure also changes how an Aug. 1 service notice is now read. On that date, Boltz disabled its EVM swaps for USDT, USDC, TBTC, WBTC, and RBTC, citing “a bug in our EVM integration,” while telling users that Lightning, Liquid, and on-chain BTC swaps were still operating normally. Those remaining swap services are now offline as well.
A core swap layer since 2019
Boltz launched in April 2019 and grew into one of the default pieces of swap infrastructure across Bitcoin’s different layers. Over time, it added Rootstock support, chain swaps between Liquid and the Bitcoin main chain, a BTCPay Server plugin, and stablecoin swaps on Tron, Solana, and EVM chains.
Wallet providers move to contain the impact
Wallets and services that use Boltz as backend infrastructure moved within hours of the announcement.
Francis Pouliot, CEO of Bull Bitcoin, said the company is “immediately shifting our priorities” to restore Lightning payments and Liquid-to-bitcoin swaps for wallet users. Until that work is done, he warned, those functions will fail without explanation.
Pouliot added that because Bull Bitcoin is a member of the Liquid federation, no user funds will be stuck on Liquid. “I will not let this situation linger. I will fix it, no matter what it takes,” he wrote.
Samson Mow, CEO of JAN3, the company behind the Aqua wallet, said restoring Liquid and Lightning swaps is now the team’s top priority. He also said Aqua has “offered to help Boltz address issues in their infrastructure.” According to Mow, user funds on Aqua remain safe and under user control.
Lightning wallet ZEUS, which runs its own instance of Boltz’s open-source stack, took that instance offline as well. “We’re following suit with our instance at swaps.zeuslsp.com,” the team wrote.
Bitcoin educator BTC Sessions described the near-term effect in simple terms: wallets that rely on Boltz for Lightning swaps “will not function as expected now,” while Liquid transactions themselves continue to work.
The suspension lands in a week of broader Bitcoin security stress
The outage comes during what the report described as one of the worst weeks for Bitcoin security in years.
An exploit affecting Coldcard hardware wallets, traced to a 2021 firmware bug that made seed phrases guessable, has drained roughly $114 million in BTC since July 30. A fourth wave of thefts hit on Monday.
Pouliot drew a direct line between the two incidents. “First, the Coldcard exploit. Now, a critical piece of Lightning infrastructure goes offline. We are undoubtedly on the losing end of the Token War,” he wrote.
Lucas Ferreira, executive director of bitcoin research and development nonprofit Vinteum, said the episode highlights the resource gap facing builders of Bitcoin infrastructure. “Boltz has a brilliant team, but it’s a small team facing increasingly sophisticated, AI-powered groups of hackers,” he wrote. “We’ll need more funding for the open-source space if we want our infrastructure to remain secure and resilient.”