Boltz suspends trading: AI attack speed far exceeds team response capabilities

Boltz suspends Bitcoin Exchange Service indefinitely

On August 3, Boltz announced an indefinite suspension of its Bitcoin Exchange Service after reporting months of artificial intelligence-assisted automatic detections and several controlled security breaches.

Overview

Boltz suspended redemption services indefinitely after reporting months of AI-assisted automatic detections and several controlled security breaches.

The company said attackers are now adapting faster than their team can identify and fix vulnerabilities.

User funds were not at risk, and Boltz stated that it bore all operating losses.

Refund APIs and customer service support are still available, but the agreement does not yet provide a reopening date.

Bull Bitcoin, Aqua and ZEUS reported that their services were disrupted due to their reliance on Boltz's redemption service.

The unmanaged exchange provider said attacks have accelerated sharply in recent days and its development team has been unable to deploy fixes as quickly as attackers adjust methods.

team stated that while still under active attack and reviewing recent security scan results, redemption services could not be responsibly restored. Boltz described the suspected attackers as "multiple resource-rich groups" but did not specifically identify them or provide independent evidence to confirm who carried out the attack.

Boltz had an EVM warning before redemption was closed

The complete shutdown follows an August 1 announcement about a Boltz Ethereum virtual machine integration vulnerability. The service initially disabled conversions involving assets such as USDT, USDC, WBTC, TBTC and RBTC, while stating that Bitcoin, Lightning Network and Liquid conversions can still work. Two days later, it stopped all redemption services.

Boltz operates the infrastructure that connects the Bitcoin main network to the Lightning Network, Liquid and other supporting networks. Its public APIs support major web applications and external integrations. The official document recommends that developers use supported software development kits as they manage redemption cryptography, recovery processes and transaction status.

In addition, Boltz said no client funds were exposed in this incident because users always controlled their assets during their atomic exchange process. The company also said that because it is a completely self-funded company, it has borne its own losses related to the controlled vulnerabilities. These statements remain unilateral statements by the company because Boltz has not yet issued a technical incident report or an independent safety review report.

The service's API is still online for collaborative refunds. According to the company, users can also complete unilateral refunds without relying on Boltz infrastructure. Its customer service team still provides support to customers with outstanding transactions.

This difference shows that unmanaged architectures can limit custody losses without causing operational disruption. Users may still hold their bitcoins, but they cannot initiate new conversions through the affected services until operations are restored or the integrated wallet is introduced to alternative providers.

Wallet is looking for alternatives to Boltz's infrastructure

Bull Bitcoin said the shutdown temporarily disabled Lightning Internet payments within its wallet and conversions between Liquid Bitcoin and on-chain Bitcoin. Standard Bitcoin transfer, Liquid transfer, wallet recovery and storage functions continue to operate normally.

The company said it is evaluating several alternatives and promises to provide a separate mechanism for customers who want to convert Liquid Bitcoin to on-chain Bitcoin. It added that its membership in the Liquid Federation allows it to convert without relying on third parties.

ZEUS also disabled its own deployed open source Boltz stack, and Aqua notified users that the service suspension affected its redemption capabilities. Neither wallet reported customer asset losses.

Previously, Blockstream has integrated Boltz into its mobile wallet to support Lightning Network and Liquid redemption. The shutdown shows that applications using shared redemption infrastructure may face service outages even if core wallet features are still available.

Boltz has not yet provided a reopen date

Boltz warned users not to expect redemption services to resume soon. It has not yet released a remediation timetable, a detailed list of vulnerabilities or conditions that must be met before operations can be restarted. The team said it will provide further updates after evaluating options.

The company attributed the attack to AI-assisted activities, a claim that is difficult to verify without technical indicators. Automatic scanning can increase the speed and number of attacks, but Boltz has not yet explained how it determines that artificial intelligence played a role in them.

Boltz's next update is expected to clarify whether automated monitoring, external audits, or changes to its open source infrastructure will be introduced before redemption services are restored.