Boltz has suspended its Bitcoin swap service after a series of AI-assisted attacks caused losses for the bootstrapped five-person company, with the shutdown announced on August 3 and a new group of veteran Bitcoiners now preparing to take over the project.
The episode points to a growing security problem for small open-source crypto services, where automated attackers can move faster than small teams can investigate and patch vulnerabilities.
Boltz Suspended Swap After Repeated Attacks #
Boltz said attackers had targeted its infrastructure with increasing frequency, intensity, and sophistication over the past several months. Several attacks succeeded, but the company stressed that its non-custodial design kept customer funds out of reach.
“The entirety of the risk was ours,” the team said, explaining that losses from the attacks led it to suspend the service on August 3 to prevent further damage. The company also said its API remained available for cooperative refunds, while unilateral refunds continued to work without relying on Boltz infrastructure.
The decision followed a difficult period for the service. On August 1, Boltz temporarily disabled EVM swaps involving $USDT, USDC, TBTC, WBTC, and RBTC while fixing a bug in its EVM integration. Lightning, Liquid, and on-chain BTC swaps were still operating at that point.
Before that, it had faced other issues, including downtime in June of its API and related services, as well as the disabling of its $USDT swaps on its .onion site in April.
By August 3, however, Boltz said the problem had become broader. The team reported a “steady rise in automated, AI-assisted probing” and several exploits, followed by a sharp acceleration in attacks during the days immediately before the shutdown. After reviewing its own security scans, the company said it could not responsibly restart swaps while multiple groups appeared to be targeting its infrastructure.
Boltz later said its five-person team did not have the resources to withstand that level of pressure over the long term. The company now has a new path forward. A group of veteran Bitcoiners has provided capital and engineering resources and agreed to take over Boltz.
Work on identifying and fixing vulnerabilities has already started, although no timetable for the return of swaps was given. The incoming group has not yet been named.
All three original founders, Kilian, Michael, and Karl, have stepped down and will have no formal role in the project.
AI Is Changing Both Sides of Bitcoin Security #
Boltz’s experience comes as other reports point to a wider use of AI in cryptocurrency-related security work. On August 10, a report on North Korea-linked Kimsuky said the group had established local AI environments using tools including Ollama, GPT4AI, and Msty. Investigators said the setup could help with malware development, document analysis, and other attack techniques.
A separate security campaign showed the other side of the equation. Sixteen researchers used AI-assisted methods to examine 390 Bitcoin-related open-source projects and reported 4,962 software issues, including 85 critical and 635 high-severity findings.
That contrast shows AI can help defenders examine code at a pace that would be difficult manually, but the same tools can give attackers faster ways to probe exposed systems. Boltz’s founders said they had reached the point where their team could not keep pace.