AI attack forces Boltz to suspend Bitcoin exchange services indefinitely

Boltz, a leading unmanaged bitcoin bridging service provider, has announced an indefinite suspension of its redemption services

Boltz, a leading unmanaged bitcoin bridging platform, has announced an indefinite suspension of its redemption services. The decision stems from a growing wave of artificial intelligence-driven attack attempts. The company said the speed at which these attacks have evolved has exceeded its ability to effectively secure operations.

Boltz suspends redemption services amid AI security threats

Boltz runs a platform that allows users to transfer bitcoins between the Lightning Network and the Bitcoin backbone. The company issued a statement on the X platform saying that all redemption operations have been suspended "before further notice" and has not yet given a specific timetable for resuming normal operations.

team clarified that the suspension was not due to a single security breach, but was due to the continued increase in automated, AI-assisted detection attacks and a number of controlled security breaches in recent months. According to Boltz, the pace of these attack attempts has become so fast that their small team cannot continue to discover and patch vulnerabilities before attackers launch another attack.

In an official update, Boltz said: "Attackers are now iterating faster than a team of our size can discover and patch vulnerabilities." The company described the shift as a "major paradigm shift for Bitcoin services running on the open source technology stack" and warned users not to expect redemption functionality to resume quickly.

As multiple complex attack groups continue to carry out targeted attacks, the redemption service will remain offline. This prevented us from resuming operations responsibly while we were working to deploy fixes. No user funds are at risk, and unilateral refunds are not dependent on our infrastructure.

The application programming interface (API) can still be used to process refunds and support services continue to run. Because Boltz operates as an unmanaged service, it never directly controls user funds. All conversions use hashed time-lock contracts, ensuring that transactions are either completed in a block or rolled back on the chain.

Boltz confirmed that despite the attack,"no user funds were ever at risk. The losses are entirely borne by us." The system supports transfers between traditional Bitcoin, Lightning Network Bitcoin and Liquid Network Bitcoin. According to DeFiLlama, the total lock-in value on Boltz is approximately $262,000.

Users can still make cooperative refunds through the API; unilateral refunds features are still available because they do not rely on Boltz's infrastructure.

Impact on Lightning's Ecosystem Wallet and Partners

Boltz's sudden suspension affects other platforms integrated with its infrastructure. Canadian bitcoin service company Bull Bitcoin has notified its wallet users that Lightning Internet payments and conversions from Liquid to Bitcoin will "fail without reason" while seeking alternative solutions. Aqua Wallet has also issued a warning and is working with Boltz to find different payment paths for Lightning Online Redemption.

These developments highlight the risks of building projects on open source financial structures with limited personnel. Yan Pritzker, co-founder of Swan, pointed out that in an environment where artificial intelligence-enhanced attacks are developing rapidly, the cost and complexity of maintaining strong security continue to rise, and small start-ups may be squeezed out of the market.

Artificial intelligence-driven attack tools mean a rising threshold for maintaining enterprise-level security, which is squeezing many innovative Bitcoin builders out of the market, especially in the field of unmanaged services.

AI threats spread across the crypto space

In the cryptocurrency space, incidents attributed to artificial intelligence are becoming increasingly common. Artificial intelligence tools have reportedly contributed to multiple high-profile attacks, such as the seed phrase attack on the hardware wallet Coldcard, which was linked to a bitcoin theft of more than $100 million. In the decentralized finance space, GoPlus Security reported four smart contract attacks in 48 hours, resulting in more than $1.5 million in losses.

The A16z cryptographic research team found that when off-the-shelf artificial intelligence agents were provided with structured attack details, their success rate in exploiting known software vulnerabilities soared from 10% to 70%. This highlights the growing severity of this threat in the field of digital asset security.