Boltz bridge shuts down after AI attacks, 5-person team exits

Boltz, the non-custodial Bitcoin swap service, suspended all swaps indefinitely on August 3 after months of AI-assisted attacks overwhelmed its five-person team.

"Attackers now iterate faster than a team our size can find and patch," Boltz wrote on X, announcing the shutdown. The team confirmed that "the entirety of the risk was ours," with losses absorbed entirely by Boltz itself, never by users.

Boltz's design protected users: swaps run through hashed timelock contracts, so a trade either completes fully or automatically reverses. The service never takes custody of user funds, and refunds don't depend on Boltz's systems staying online — which is why the service could go dark for ten days without trapping a single user's coin. The bridge connects Bitcoin mainchain, Lightning, and Liquid, and had added USDT swaps in March, letting users move between Bitcoin layers without handing custody to an exchange.

The shutdown raises hard questions about whether small open-source teams can survive AI-driven attackers. A group described only as "veteran Bitcoiners" has agreed to take over, bringing capital and engineering firepower. No relaunch date has been set, and the incoming team's identity hasn't been disclosed.

The broader attack wave

The pressure on cross-chain infrastructure is mounting. CoinDesk reported on July 23 that Verus, B2 Network, and other cross-chain systems lost more than $35 million in several attacks within hours. Verus was hit for about $7.54 million; B2 Network lost roughly $3.86 million after an attacker seized upgrade authority over a staking contract.

Voltage, a Lightning infrastructure company, made a different but related call this summer, shutting off new self-serve infrastructure on July 13 and shifting focus to enterprise customers. That wasn't a hack story — it was a business decision. Still, it shows the same pressure from another angle: serving small users at scale is hard, and the economics of Bitcoin infrastructure don't always reward the teams doing the useful plumbing.

The outgoing founders won't be part of the technical work going forward. "It was a hell of a ride," they wrote, closing with "Godspeed to the new Boltz team."

For users, the practical lesson is simple: check service status before swapping, and keep rescue keys and refund data. A non-custodial label doesn't mean nothing can go wrong — it just means the failure mode is different. The gap between what large custodians like Coinbase and Kraken can spend on security and what a lean open-source project can afford is widening, and users may drift back toward the large custodians they were trying to avoid.

This article is for informational purposes only and does not constitute investment advice.