Boltz, a non-custodial Bitcoin swap provider, has suspended its swaps indefinitely after attackers discovered vulnerabilities in its protocol faster than the team could patch them, according to a post on X.
The service allows users to exchange Bitcoin without depositing funds with a custodian. Each vulnerability discovery triggered a race between the attacker and Boltz's engineers: the company had to identify the flaw, develop a fix, deploy it, and secure the protocol before exploitation occurred. When that cycle broke down, the company chose suspension over continued exposure.
Boltz did not name the attackers or disclose whether any funds were taken. The company said it would resume swaps only after addressing the underlying issues that made its patch cadence insufficient. Non-custodial bridges have drawn sustained security attention since 2023, when cross-chain platforms including Ronin and Poly Network suffered major exploits. Unlike centralized exchanges, these services distribute custody, which removes a single point of failure but distributes the attack surface across smart contracts and bridge logic.
Security researchers and attackers have begun using automated tools and machine learning to find protocol bugs at scale. A researcher working on vulnerability detection told Cointelegraph in March 2026 that AI-assisted scanning had reduced the time to identify certain classes of smart contract bugs from weeks to hours. Boltz encountered attackers whose pace of discovery exceeded its pace of remediation.
Boltz has not published a timeline for resuming service. The company operates on Liquid Network, a sidechain maintained by Blockstream, and also offers lightning swaps. Neither service was mentioned in the suspension notice, leaving open whether the shutdown applies only to on-chain swaps or the full product line.
Non-custodial swap protocols occupy a narrow market niche between centralized exchanges and on-chain DEXs. Boltz competes with services like Stacks and BTCLN, which offer swap functionality at different risk-return profiles. The suspension removes liquidity from a segment already constrained by security and regulatory uncertainty.
Code review and patching are inherently slower than code execution. If attackers can instrument their searches at the speed of computation, defenders cannot match that pace through human work alone. Boltz chose to suspend rather than patch incrementally.
