Boltz Hands Over Control, But Won’t Say Who’s Taking It or How Much Was Lost

MakeCryippreferred on

Boltz’s three founders stepped down from the company on Aug. 13, handing control of the non-custodial Bitcoin swap service to a group it identified only as veteran Bitcoiners. Kilian Rausch, Michael and Karl said in a statement that none of them will hold any further formal role at Boltz going forward.

The Two Numbers Missing From the Statement

Boltz’s announcement explained why the founders left and confirmed that no user funds were ever at risk. It did not say how much money Boltz itself lost in the attacks that forced the change, or who is now running the infrastructure that Aqua Wallet, Bull Bitcoin and other services still route swaps through. Neither figure has surfaced since. Boltz said only that the incoming team is bringing capital and engineering resources, without naming anyone or putting a number on the damage.

Other services that shut down after a breach this year set a different bar. SecondFi, a Cardano wallet provider, disclosed that its breach cost users about $2.6 million in ADA before it wound down.

Months of AI-Assisted Attacks

The handover follows a suspension that began Aug. 3, when Boltz took its swap service offline entirely. The company said automated, AI-assisted attacks had grown more frequent and sophisticated over the prior months, coming from multiple capable groups working independently rather than a single actor. Several attempts succeeded, though Boltz said it caught and contained each one.

Boltz’s swaps run on hashed timelock contracts, so a trade either completes on both sides or reverses entirely within one block. That structure kept customer funds out of reach even when Boltz’s own systems were breached, and the company said it absorbed every loss itself instead of passing costs on to users. Boltz has run as a five-person, bootstrapped team since launching in 2019. The incoming group has agreed to bring both capital and engineering staff, not just code fixes.

Other non-custodial platforms have made the same move under attack. Zerion pulled its web app offline in April after flagging abnormal activity, then confirmed user funds stayed safe because it never held the keys in the first place. Two days before the full suspension, on Aug. 1, Boltz had already disabled swaps involving USDT, USDC, TBTC, WBTC and RBTC over a separate bug in its Ethereum-side integration. Lightning, Liquid and on-chain Bitcoin swaps kept running at that point. The wider shutdown two days later covered everything.

A Second Transparency Gap in Two Weeks

This is not the first unanswered question Boltz has left open this month. The company runs a warrant canary, a signed statement it renews on a set schedule to show it has not been secretly compelled by a government order. Its previous canary promised a refresh every 60 days from a May 31 signing, which put the deadline at July 30. Boltz did not sign a new one until Aug. 5, six days late and two days after the swap suspension began.

• May 31: Boltz signs its most recent warrant canary before the gap.
• July 30: The 60-day renewal window the canary promised runs out.
• Aug. 1: Boltz disables swaps for USDT, USDC, TBTC, WBTC and RBTC over an integration bug.
• Aug. 3: Boltz suspends all swap services, citing the AI-assisted attacks.
• Aug. 5: Boltz signs a new warrant canary, saying it received no government requests.
• Aug. 13: Boltz announces its three founders have stepped down and an unnamed group is taking over.

Bitcoin commentator Adam Simecka argued on X that the delay looked like a sign Boltz had been compelled or captured by an outside party. Francis Pouliot of Bull Bitcoin countered that the gap was a missed manual step, saying he had been in direct contact with Boltz throughout the shutdown and saw no sign of coercion. When Boltz did renew the canary, it said it had received zero requests for information from any government agency.

Swaps Remain Down

Boltz’s swap service has stayed offline since Aug. 3. Bull Bitcoin and Aqua Wallet, which both route Lightning and Liquid swaps through Boltz, told their own users to expect failures and began looking at alternatives. Blockstream launched a competing swap product while Boltz was down.

Boltz said work to find and fix the vulnerabilities behind the suspension is already underway, without giving a timeline for when swaps might return. The company said it is withholding the new owners’ names for now so they can introduce themselves on their own schedule.

Not every hacked protocol comes back quickly. Radiant Capital spent 18 months trying to recover from an October 2024 breach before shifting to maintenance mode this year, with active development halted for good.