Boltz Temporarily Suspends Service Following AI-Driven Hack Attacks

Boltz, a non-custodial Bitcoin swap provider, has paused its service “until further notice,” citing what it describes as a sharp rise in automated, AI-assisted probing attempts against its infrastructure. In a statement published on X, the team said multiple exploits over recent months were contained individually, but that the pace of attacker iteration has begun to outstrip the ability of a small security team to find and patch issues quickly.

The pause arrives amid broader concern across crypto that AI capabilities—when paired with automation—can compress the time between vulnerability discovery and real-world exploitation. Boltz also emphasized that the shutdown is an operational decision rather than a response to customer losses, stating that no user funds have been at risk due to the non-custodial nature of its swaps.

Key takeaways

• Boltz is disabling swaps temporarily after reporting an accelerated pattern of “automated AI-assisted probing” in recent months.
• The company says its team cannot patch vulnerabilities quickly enough relative to attacker iteration speed, despite containing prior exploits.
• Boltz states that swaps are cryptographically secured and non-custodial, and that no user funds have been at risk.
• Solana’s security leadership has argued for “autonomous defense” to match threats operating at machine speed.

Boltz pauses swaps as automated probing intensifies

In its X post, Boltz attributed the decision to a “steady increase” in automated AI-assisted attempts to probe its systems over the course of this year. The firm said it has dealt with several exploits during that period; while each incident was contained, the overall pattern—attackers iterating faster than the service’s ability to remediate—has become difficult to manage.

“Over the past months… we have dealt with several exploits. Each was contained, but the pattern is clear: attackers now iterate faster than a team our size can find and patch.”

After reviewing security scans, Boltz said it cannot responsibly re-enable swaps while it is still being actively targeted by multiple groups, and while fixes are in progress. The company also described a recent acceleration, stating that within just a few days it saw a “drastic acceleration” in attacks and does not believe the asymmetry will reverse soon.

For users, the practical implication is straightforward: swap execution is paused, and the company is effectively prioritizing security remediation over service continuity. For builders and investors, Boltz’s decision is another sign that as threats become more automated, smaller teams running open-source infrastructure may face rising operational risk—especially when patch cycles are measured against attacker speed rather than human-led testing schedules.

Non-custodial design remains, but swap operations are suspended

Boltz’s service enables non-custodial, trustless atomic swaps, including transfers between Bitcoin mainnet and Bitcoin-related layers such as Lightning Network and Liquid Network. Because the swaps are non-custodial, Boltz said users retain full control of assets throughout the process.

The company stressed that, despite the security incidents it has described, no user funds have ever been at risk. Boltz’s reasoning is tied to its cryptographic approach: the swap mechanism is built so that custody is not transferred to Boltz in a way that would expose users to direct theft of funds.

Boltz also said its API will remain available to process refunds, and that its support team will continue to be reachable. That matters for downstream users and integrators because it suggests the pause is focused on swap re-enablement rather than an abrupt cessation of all related functionality.

“What we are seeing is a major paradigm shift for Bitcoin services operating on an open source stack, and it needs careful analysis. Do not expect swap services to resume shortly.”

At the time of writing, DefiLlama data showed Boltz’s total value locked at $180,860, providing a snapshot of the service’s on-chain footprint while it remains paused.

Why AI-driven automation raises the patching bar

Boltz’s announcement reflects a recurring theme in crypto security: when attackers can automate discovery and testing, the window for defenders to respond shrinks. The firm’s complaint is not only that vulnerabilities exist, but that the attack pattern is now iterative and fast enough that a small team cannot keep up with the remediation workload—even when individual exploits are contained.

This tension between offense speed and defense capacity is also echoed by Solana Foundation’s security leadership. Earlier coverage of Solana Foundation’s chief information security officer, Michael Coates, pointed to a need to move beyond purely human-scaled security processes. In July, Coates told Cointelegraph that the industry has reached a “tipping point” where humans cannot scale to meet AI-enabled threats.

“The only path forward we have is to have autonomous defense that operates at the speed of machines.”

That framing helps explain why Boltz’s response may be longer-term than a routine patch cycle. If defenders can’t reliably close the loop faster than attackers probe and iterate, even “contained” incidents may signal an ongoing risk environment rather than an isolated problem.

Boltz’s operational decision also mirrors comments from other crypto-adjacent services dealing with frequent exploitation. PayPerQ, an AI prompt-payment platform that accepts payment in Bitcoin and other cryptocurrencies, said it has been fighting off exploits every other week for several months and believes many could be AI-powered. The company described the current situation as “very dangerous,” reinforcing the idea that AI assistance may be becoming a force multiplier for attackers.

What investors and users should watch next

Boltz has not offered a timeline for re-enabling swaps, and its statement explicitly cautions that swap services should not be expected to resume shortly. The key question for users is whether Boltz can reduce the probing-to-patching gap through changes to its security posture—such as tighter monitoring, faster remediation pipelines, and more automated defenses—before attacker iteration once again outpaces its team size.

For the broader Bitcoin ecosystem, Boltz’s pause is a timely reminder that non-custodial design can limit direct user fund exposure, but it does not eliminate operational and reliability risks. Readers should watch for how quickly Boltz can restore swap functionality, and whether the industry’s push toward machine-speed security becomes a practical requirement rather than a theoretical goal.