Boltz, a non-custodial Bitcoin swap provider that enables atomic swaps between Bitcoin's mainchain, the Lightning Network, and the Liquid sidechain, has taken its platform offline indefinitely following months of increasingly sophisticated AI-driven cyberattacks targeting its infrastructure. The decision highlights growing concerns across the cryptocurrency sector about automated hacking tools outpacing the defensive capabilities of small, open-source development teams.

Service Suspension Follows Sustained AI-Driven Assaults

Boltz announced that its swap services will remain disabled until further notice after experiencing a steady campaign of automated, AI-powered probing that produced multiple exploit attempts over recent months. The company emphasized that the shutdown was not prompted by any single security incident but rather by the cumulative effect of continuous automated attacks.

Update: Boltz will stay disabled until further notice. Our API remains available to process refunds cooperatively. In any case, unilateral refunds will work, as they do not depend on our infrastructure. Our support team stays reachable. To be clear: this is not a response to a… — Boltz – Non-Custodial Bitcoin Bridge (@Boltzhq) August 3, 2026

Although all incidents were contained, Boltz acknowledged that the attacker is discovering and exploiting vulnerabilities faster than the company can detect and remediate them. The situation intensified significantly over the days preceding the suspension, prompting Boltz to keep the platform offline while it evaluates the results of its latest in-house security analyses.

Refunds Remain Fully Operational

Despite the suspension of swap functionality, Boltz confirmed that its API remains available for processing cooperative refunds. Users can also initiate unilateral refunds, which function independently of Boltz's infrastructure through the platform's underlying cryptographic protocols.

Because Boltz operates as a non-custodial service, users never relinquish control of their Bitcoin during the swapping process. All funds remain under user control via cryptographic mechanisms — specifically Hashed Timelock Contracts (HTLCs) — at every stage of the transaction. This architectural choice means that even during an extended service outage, users can recover their funds without relying on Boltz's servers. The company emphasized that no customer assets have been placed at risk at any point.

Boltz also noted that it is a fully bootstrapped company and has never charged clients any fees related to financial losses stemming from security events.

Open-Source Bitcoin Infrastructure Faces Mounting Pressure

Boltz described the recent attacks as part of a larger trend affecting Bitcoin's open-source ecosystem. According to the company, well-funded threat actor groups are actively deploying AI to accelerate both vulnerability discovery and exploit development, compressing the time between identifying a weakness and weaponizing it.

The announcement serves as a broader wake-up call for the cryptocurrency sector as AI increasingly reshapes the cybersecurity landscape. Security researchers have documented a steady rise in AI-assisted offensive tools — including automated fuzzing frameworks, large language models capable of identifying code flaws from public repositories, and self-refining exploit generators. Unlike traditional manual methods, these tools can rapidly scan codebases, identify vulnerabilities, and iteratively refine attack techniques at a pace that smaller infrastructure providers struggle to match.

Boltz's situation also underscores a structural tension within Bitcoin's open-source infrastructure layer: critical services are often maintained by small, bootstrapped teams, while the threat landscape increasingly resembles the resource-intensive environment of traditional enterprise cybersecurity. Projects like Boltz, which occupy a key interoperability role connecting Bitcoin's base layer to its Layer 2 scaling solutions, may face growing pressure to adopt more robust security practices — including formal code audits, bug bounty programs, and AI-assisted defensive tooling — even as they operate with limited budgets.

Boltz has not provided a timeline for restoring its swap services and has cautioned users not to expect a rapid reopening. The company stated that it must first develop a comprehensive understanding of the evolving threat landscape before determining its next steps.

Source: CryptoNinjas