Boltz Suspends Bitcoin Swaps as AI-Assisted Attacks Outpace Its Fixes

• Boltz disabled its Bitcoin, Lightning, and Liquid swaps indefinitely on August 3, saying AI-assisted attackers were finding vulnerabilities faster than its team could patch them.
• The company said several exploits over recent months were each contained and no user funds were at risk, because its swaps are non-custodial.
• Wallets that used Boltz as backend infrastructure, including Bull Bitcoin and Aqua, lost Lightning and Liquid swap functionality and are evaluating alternatives.

Boltz suspended its Bitcoin swaps indefinitely on Monday, August 3, saying AI-assisted attackers were surfacing vulnerabilities in the non-custodial bridge’s infrastructure faster than its small team could patch them.

Boltz routes atomic swaps between Bitcoin’s base chain, the Lightning Network, and the Liquid sidechain, and has served as backend plumbing for several Bitcoin wallets since 2019. The company first took the service offline without explanation, then published a fuller account on X roughly six hours later. DeFiLlama now lists the protocol as deprecated, showing about $262,188 in total value locked and a 15.8% decline over the past 30 days.

Why Boltz Bitcoin Swaps Went Dark

Boltz framed the shutdown as a response to a months-long pattern of intrusions. Automated, AI-assisted probing of its infrastructure has risen steadily through the year, the company said, and several exploits were each contained. The conclusion it drew was blunt: attackers now iterate faster than a team our size can find and patch.

Boltz said its own recent security scans convinced it that re-enabling swaps would be irresponsible while multiple well-resourced groups keep targeting it. The company offered no restart timeline and told users not to expect swaps back soon. Its API stays online to process cooperative refunds; unilateral refunds keep working because they do not depend on Boltz servers, and the support team remains reachable.

No user funds were ever at risk, according to Boltz, because its hashed timelock contracts leave customers in control of their coins throughout a trade. Boltz absorbed the cost of the contained exploits on its own books. The statement also recast an August 1 notice, in which the company disabled swaps for USDT, USDC, TBTC, WBTC, and RBTC over a bug in its EVM integration.

Wallets that treated Boltz as infrastructure moved within hours. Bull Bitcoin and Aqua, the wallet built by JAN3, both lost Lightning and Liquid swap functionality and began evaluating alternatives. “I will not let this situation linger,” Bull Bitcoin CEO Francis Pouliot wrote.

AI Is Compressing the Patch Window

The shutdown lands in a punishing month for Bitcoin holders. Attackers exploiting a 2021 Coldcard firmware flaw have drained roughly $130 million from self-custodied wallets, according to Galaxy Research, two months after Trezor and Tropic Square disclosed a separate chip vulnerability in the Safe 7 hardware wallet. Automated attacks on crypto infrastructure have grown routine, as the backdoored Injective npm SDK showed in July.

Anthropic reported in June that the share of medium-risk or higher threat actors using AI in cyber operations rose from 33% to 56% over the year to March 2026. Bridge infrastructure has been a repeat failure point, as LayerZero’s admission over the $292 million Kelp DAO exploit showed in May. Boltz called the shift a structural problem for Bitcoin services built on open source stacks and said it needs careful analysis. Whether small teams can fund machine-speed defense is now a live question for the rest of Bitcoin’s swap layer.

Editorial Note: Reported and edited by the Crypto India Magazine editorial team. We use AI tools to assist with research and drafting; every article is reviewed and fact-checked by our editors.

Interested in advertising with CIM? Talk to us!