Boltz handed over control but declined to disclose who took over and the amount of the loss

Boltz's three founders stepped down on August 13 and handed over control of the unmanaged bitcoin exchange service to a team that called themselves "veteran bitcoin players."

Kilian Rausch, Michael and Karl said in a statement that they will not hold any formal positions in Boltz thereafter.

Updates on Boltz's future

In the past few months, AI-assisted attackers have targeted Boltz more frequently, violently and in complexity. Several of these attacks were successful, but due to Boltz's unmanaged model, user funds were never at risk...

-- Boltz-Unmanaged Bitcoin Bridge (@Boltzhq) August 12, 2026

Two missing figures in the statement

Boltz's announcement explained the reason for the founder's departure and confirmed that user funds were never damaged, but did not disclose how much money Boltz himself lost due to the attack that forced the change. It also doesn't say who currently runs the infrastructure through which services such as Aqua Wallet and Bull Bitcoin are still redeemed. Since then, neither number has been made public. Boltz only said that the new team brought funds and engineering resources, but did not disclose the specific names or the amount of the losses.

Other services that were shut down after attacks this year set different standards. Cardano wallet provider SecondFi disclosed that its vulnerability caused users to lose approximately $2.6 million in ADA and was subsequently suspended.

AI-assisted attack lasting several months

Prior to this handover, Boltz suspended services from August 3 and completely offline its redemption business. The company said automated AI-assisted attacks have become more frequent and complex in the past few months, and have been launched by multiple independent capable groups rather than a single attacker. Several attacks were successful, but Boltz said he had discovered and contained each attack.

Boltz's redemption business runs based on hashed time-lock contracts, so a transaction is either completed between both parties or completely revoked within a block. This structure ensures that even if Boltz's own systems are breached, customer funds cannot be reached. The company says all losses will be borne by itself and will not be passed on to users. Since its launch in 2019, Boltz has been operating as a five-person team and self-funded. The new team has agreed to not only fix the code, but also bring in money and engineering staff.

Other unmanaged platforms have taken the same steps when attacked. Zerion took its web application offline in April after discovering unusual activity and later confirmed that user funds were safe because it never held a key. Two days before the full service suspension, on August 1, Boltz disabled exchanges involving USDT, USDC, TBTC, WBTC and RBTC due to a separate vulnerability in Ethereum integration. Lightning, Liquid and on-chain bitcoin conversions were still in operation at the time. A complete shutdown two days later covered all businesses.

Second transparency gap in two weeks

This is not the first unanswered question Boltz left behind this month. The company operates a "search warrant canary"-a regularly updated signed statement to show that it is not secretly mandated by a government order. A previous Canary promise to be updated every 60 days from signing on May 31, with a deadline of July 30. But Boltz did not sign the new statement until August 5, six days late and two days after the exchange suspension began.

Search warrant Canary timeline

May 31: Boltz signs the latest search warrant for Canary before the gap.

July 30: Canary's promised 60-day update window expires.

August 1: Boltz disabled conversions of USDT, USDC, TBTC, WBTC and RBTC due to an integration vulnerability.

August 3: Boltz suspended all redemption services citing AI-assisted attacks.

August 5: Boltz signs a new search warrant for Canary, saying he has not received any government request.

August 13: Boltz announced that three founders will step down and an unnamed team will take over.

Bitcoin commentator Adam Simecka pointed out on X that the delay appears to indicate that Boltz is being coerced or controlled by an external party. Bull Bitcoin's Francis Pouliot countered that the gap had simply missed a manual step, saying he had been in direct contact with Boltz during the outage and found no signs of coercion. When Boltz finally updated Canary, it stated that it had not received any requests for information from government agencies.

Exchange service is still offline

Boltz's redemption service has been offline since August 3. Bull Bitcoin and Aqua Wallet, which exchanged Lightning and Liquid via Boltz, both informed users that a possible failure was occurring and began to look for alternatives. Blockstream launched competitive redemption products during Boltz's outage.

Boltz said work was underway to find and fix the vulnerability that caused the suspension, but did not give a timetable for the resumption of redemption services. The company said it would not disclose the names of the new owners for now so that they can introduce themselves at their own schedule.

Not all attacked protocols can be restored quickly. After being attacked in October 2024, Radiant Capital spent 18 months trying to recover. This year, it switched to maintenance mode and active development has been permanently suspended.