Boltz, a non-custodial Bitcoin swap service, has shut down after months of AI-assisted automated hacking attacks overwhelmed its small team. The company said user funds remained safe throughout — a direct result of its non-custodial design — but the pace of AI-driven exploit discovery and exploitation outpaced what the team could patch. Boltz absorbed the financial losses from successful attacks on its own books.
How AI changed the attack surface
Attackers used AI to automate vulnerability probing and exploit discovery, finding and exploiting weaknesses faster than Boltz's small team could respond. This isn't an isolated case. Google's Chrome team now uses AI to triage vulnerabilities and generate candidate fixes, saving hundreds of developer hours per month — but that level of automation is out of reach for most crypto startups.
Anthropic analyzed 832 banned accounts between March 2025 and March 2026 and found attackers increasingly relying on AI to scan targets and collect data. CISA told federal agencies in June that AI helps both researchers and attackers find flaws at a similar pace, pushing the riskiest vulnerabilities toward patch windows measured in days.
Broader industry toll
TRM Labs reported that infrastructure and operational compromises accounted for roughly 76% of crypto hack losses in the first half of 2026, though only about 15% of incidents. CertiK identified wallet compromise as the costliest category, with over $4 billion in losses in the same period. Boltz's non-custodial model meant attackers couldn't touch user wallets directly, but the service itself became the target.
The Open Source Security Foundation is building tools to triage and validate AI-generated vulnerability reports before they reach a maintainer. OpenJS warned that a flood of low-quality, AI-written vulnerability reports can consume maintainer time even when no real vulnerability exists — a problem Boltz's team likely faced alongside actual exploits.
The two-front war for small teams
Small crypto teams now fight a two-front security war: real automated exploit attempts and automated noise from AI-generated reports that consume attention. Boltz's shutdown shows that even a well-designed non-custodial service can be forced offline when the attacker's automation outruns the defender's. The company's decision to close rather than risk user funds is a stark reminder that in crypto, security design matters — but so does the size of the team behind it.
What comes next for Boltz's users? The service is winding down, but because it was non-custodial, users retain control of their funds. For the broader industry, the question is whether small teams can survive an environment where AI gives attackers a speed advantage that only well-resourced organizations can match.
