UPDATE ON THE FUTURE OF BOLTZ 📢

Over the past couple of months, AI-assisted attackers have been targeting Boltz with increasing frequency, intensity and sophistication. Several of these attacks succeeded, but because Boltz is non-custodial, user funds were never at risk. The entirety of the risk was ours, and as a result of the losses incurred, on August 3rd we made the difficult decision to suspend the service to prevent further damage.

While working on a plan to bring Boltz back over the past days, we had to accept one painful insight: as a bootstrapped five-person startup, we simply don't have the resources to withstand the current level of attacks in the long run.

Today, we are happy to announce that a group of veteran Bitcoiners came forward to help, bringing the capital and engineering power the project needs. They have agreed to take over Boltz and continue the service. Work to find and fix the vulnerabilities is already under way, with the goal of bringing swaps back as soon as possible.

As we want to give them the freedom to introduce themselves in their own time, we are not attaching any names today.

All original founders of Boltz have stepped down from the company, effective immediately. None of us will have any formal or authoritative role with the Boltz project going forward, and any future open-source participation by us is strictly on a voluntary basis.

We are grateful for the community's support all these years, for the patience and understanding of our integrators affected by the disruption of our service, and to everyone who reached out offering support over the past week.

It was a hell of a ride, and we are proud of our contributions to the Bitcoin ecosystem.

Godspeed to the new Boltz team as they navigate these perilous times. We know Boltz is in good hands.

- Kilian, Michael & Karl

Update: Boltz will stay disabled until further notice.

Our API remains available to process refunds cooperatively. In any case, unilateral refunds will work, as they do not depend on our infrastructure.

Our support team stays reachable.

To be clear: this is not a response to a single incident. Over the past months we have seen a steady rise in automated, AI-assisted probing of our infrastructure, and we have dealt with several exploits. Each was contained, but the pattern is clear: attackers now iterate faster than a team our size can find and patch. In the past few days alone we saw a drastic acceleration, and we do not believe this asymmetry will reverse. After reviewing the results of our own recent security scans, we cannot responsibly re-enable Boltz swaps, especially as we are being actively targeted by what appear to be multiple resourceful groups while we race to deploy fixes.

What we are seeing is a major paradigm shift for Bitcoin services operating on an open source stack, and it needs careful analysis. Do not expect swap services to resume shortly.

To be explicit: no user funds were ever at risk. Boltz is non-custodial by design. And as a fully bootstrapped company, the losses were ours alone.

We don't know yet how things will continue from here, but we'll keep you posted as soon as we have had the time to catch our breath and make a decision 🙏