Boltz disables Bitcoin swaps indefinitely after AI attacks on $262K TVL

Boltz disabled all Bitcoin, Lightning and Liquid swaps on Aug. 3 after months of AI-assisted attacks, affecting $262K in TVL.

"Over the past months we have seen a steady rise in automated, AI-assisted probing of our infrastructure, and we have dealt with several exploits," the team wrote on X. "Each was contained, but the pattern is clear: attackers now iterate faster than a team our size can find and patch."

The shutdown followed an Aug. 1 notice disabling EVM swaps — USDT, USDC, WBTC, TBTC and RBTC — after a bug in the protocol's EVM integration. DefiLlama showed roughly $262,187 in total value locked on Boltz at press time. The protocol said no user funds were ever at risk because its atomic swap design keeps users in control of their coins throughout a swap, and that as a fully bootstrapped company, "the losses were ours alone."

The suspension cuts off swap rails behind Lightning and Liquid payments in wallets including Bull Bitcoin and Aqua, forcing those teams to scramble for alternatives. Boltz warned users not to expect services to resume soon, calling the episode "a major model shift for Bitcoin services operating on an open source stack."

Wallets Scramble for Alternative Rails

Bull Bitcoin CEO Francis Pouliot said the company is "immediately shifting our priorities" to restore Lightning payments and Liquid-to-bitcoin swaps for its wallet users, warning that until then those functions will fail without explanation. Because Bull Bitcoin is a member of the Liquid federation, he said, no user funds will be stuck on Liquid.

Samson Mow, CEO of JAN3, the firm behind the Aqua wallet, said restoring Liquid and Lightning swaps is the team's top priority and that Aqua has "offered to help Boltz address issues in their infrastructure." Lightning wallet ZEUS, which runs its own instance of Boltz's open-source stack, also took its swap service offline.

The incident lands in a difficult week for Bitcoin security. An exploit of Coldcard hardware wallets, traced to a 2021 firmware bug that made seed phrases guessable, has drained roughly $114 million in BTC since July 30. Pouliot drew the line between the two events directly: "First, the Coldcard exploit. Now, a critical piece of Lightning infrastructure goes offline. We are undoubtedly on the losing end of the Token War."

Solana Foundation security chief Michael Coates previously argued that crypto companies will need autonomous defenses because human teams cannot respond at machine speed. "We're at a tipping point as an industry where humans cannot scale to meet these threats," Coates said. "The only path forward we have is to have autonomous defense that operates at the speed of machines."

PayPerQ, a pay-per-prompt AI service that accepts cryptocurrency, also said it has faced frequent exploits it suspects are AI-powered. "We've been fighting off exploits every other week for several months, most of which we believe are AI-powered," the company said.

Boltz's API remains online to process refunds cooperatively, and unilateral refunds work without its infrastructure. Users with unfinished swaps should keep their swap ID, refund file, recovery keys and other transaction information. The protocol has not published a reopening date.

This article is for informational purposes only and does not constitute investment advice.