Zeus Wallet halts Lightning services after breach, 3rd outage in week

Zeus Wallet became the third Lightning service provider in a week to suspend operations after a cybersecurity incident, taking its infrastructure offline Aug. 5 while it audits all systems.

Zeus Wallet took its Lightning Network infrastructure offline Aug. 5 after detecting a cybersecurity incident, suspending services while the company conducts a full audit of all systems before restoring operations.

"Based on our investigation so far, we believe this incident was limited to Zeus infrastructure," Evan Kaloudis, founder of Zeus, said in a company blog post.

Zeus said the attack was contained within hours and that no customer funds were lost or placed at risk. The company said it found no evidence the incident stemmed from a vulnerability in Lightning node software. Customers whose Lightning Service Provider channels closed during the attack will receive replacement channels after operations resume, Kaloudis said. Zeus has not disclosed how the attacker gained access, which systems were affected, or whether any data was exposed, and has not provided a timeline for restoring services.

The outage follows Boltz's suspension of non-custodial Bitcoin swap services on Aug. 3, which prompted Zeus to disable its own swap functionality. Bitcoin traded at $64,535 as of Aug. 6, down 0.2 percent over 24 hours, according to CoinGecko. The incidents come as the Bitcoin ecosystem faces heightened security scrutiny after the Coldcard hardware wallet attacks, which saw 1,596 BTC stolen from roughly 7,300 addresses.

Lightning infrastructure under pressure

The three outages — Boltz, AQUA, and Zeus — have raised questions about the resilience of centralized Lightning infrastructure, though network-level metrics remained broadly stable. Public Lightning capacity increased by 28 BTC (0.61 percent) to 4,522 BTC during the week ending Aug. 6, while the number of public payment channels grew by 256 (0.59 percent) to 43,900, according to Amboss data. Publicly accessible nodes fell by 108 (0.73 percent) to 14,760.

The incidents highlight the distinction between self-custody and infrastructure dependence. Zeus operates as a self-custodial wallet, meaning users retain control of their private keys, but many rely on Zeus's Olympus Lightning Service Provider to open and manage payment channels. That centralized layer can disrupt payments even when user funds remain secure.

Security review accelerates across Bitcoin ecosystem

The Zeus incident arrives as the Bitcoin Red Team, a volunteer-led initiative, reviews open-source Bitcoin projects using AI-assisted analysis combined with manual verification. The group examined 390 Bitcoin-related repositories in the first 29.8 hours, identifying 4,962 potential security issues, with 720 classified as high or critical severity, according to data shared by the group.

The review follows the Coldcard hardware wallet attacks, which investigators linked to a firmware flaw introduced in March 2021. Galaxy Research confirmed attackers stole 1,596 BTC from roughly 7,300 addresses across three attack waves, with a suspected fourth wave involving another 448.7 BTC from 709 likely victim addresses.

Zeus said the incident reinforces its work on trusted execution environments and the Validating Lightning Signer project, which separates private-key signing from the Lightning node and checks transactions against predetermined policies. The company completed a SOC 2 Type II audit in April 2026.

For Zeus, the immediate priorities are completing the security audit, replacing affected channels, and explaining what caused the attack. The company's next disclosure will determine whether the incident remains a contained infrastructure outage or exposes deeper weaknesses in the services built around its self-custodial wallet.

This article is for informational purposes only and does not constitute investment advice.