[Unofficial] Boltz exchange - Bitcoin atomic swaps

[Pmalek]

<Snip>

Judging by their reply in that screenshot you posted, it's a problem that Alchemy and its team need to fix. Perhaps the issue only exists when you use the Onion version of Boltz, while on clearnet it works as it should. How did you perform the swap? Did you do it over Tor or clearnet?

[Forsyth Jones]

<Snip>

Judging by their reply in that screenshot you posted, it's a problem that Alchemy and its team need to fix. Perhaps the issue only exists when you use the Onion version of Boltz, while on clearnet it works as it should. How did you perform the swap? Did you do it over Tor or clearnet?

I started the swap over Tor.

Updating you all:

The swap continued to have problems, failing to communicate with this Alchemy. After about 24 hours, the refund button appeared, so I received my funds back in full, minus the fees.



One thing they said is that even if I close the tab, as long as I have the rescue key, I can restore the swap. However, when I upload the rescue key in another browser, I can't access the swap, it only appears listed, but is never accessible. Boltz's UX needs to be greatly improved.

[Pmalek]

I started the swap over Tor.

Updating you all:

The swap continued to have problems, failing to communicate with this Alchemy. After about 24 hours, the refund button appeared, so I received my funds back in full, minus the fees.

It's good that you got your refund. Bad experience overall, though.

One thing they said is that even if I close the tab, as long as I have the rescue key, I can restore the swap. However, when I upload the rescue key in another browser, I can't access the swap, it only appears listed, but is never accessible. Boltz's UX needs to be greatly improved.

Thanks for the feedback. Anyone thinking of using the current beta version of Boltz over Tor should keep this in mind. I hope these problems don't occur with other assets on the clearnet and the official release.
What does it mean when you said that you can't access the swap and that it only appears as listed? What is "listed" and what was missing?

[Pmalek]

Boltz exchange has now launched USDC swaps on its main platform. Previously, it was only available over the beta site. Just as it was during the beta testing stage, users can select from several blockchains, such as Ethereum, Arbitrum, Solana, Base, Tron, etc., and swap for bitcoin, LN, LBTC, RBTC, etc.

I hope that Boltz was able to fix and improve the service so we don't see the things that Forsyth Jones experienced when he tried to swap.

[Forsyth Jones]

Boltz exchange has now launched USDC swaps on its main platform. Previously, it was only available over the beta site. Just as it was during the beta testing stage, users can select from several blockchains, such as Ethereum, Arbitrum, Solana, Base, Tron, etc., and swap for bitcoin, LN, LBTC, RBTC, etc.

I hope that Boltz was able to fix and improve the service so we don't see the things that Forsyth Jones experienced when he tried to swap.

I also saw that they added USDt and USDc to the .onion link as swap options as well... previously, they had removed USDt from the .onion domain after my report to support.

I haven't needed to use boltz after this episode, as I use them when I need to swap amounts in Liquid. I hope everything is working well.

[Forsyth Jones]

Boltz claims to be suffering a massive coordinated group attack using AI on its infrastructure. In response, they halted all swaps indefinitely until they implemented the necessary, they stated that the service is not expected to resume anytime soon.

They also stated that no user funds were compromised, as it is a non-custodial service by design, and that the losses were entirely on their side.

Some Boltz users report that Boltz crashes most of the time when they need to use the service.

What we are seeing is a major paradigm shift for Bitcoin services operating on an open source stack, and it needs careful analysis. Do not expect swap services to resume shortly.

To be explicit: no user funds were ever at risk. Boltz is non-custodial by design. And as a fully bootstrapped company, the losses were ours alone.

[Pmalek]

Boltz claims to be suffering a massive coordinated group attack using AI on its infrastructure. In response, they halted all swaps indefinitely until they implemented the necessary, they stated that the service is not expected to resume anytime soon.

This is sadly an expected aftermath following the Coldcard saga. Blackhats are now going to target open-source bitcoin and crypto projects, hoping to discover vulnerabilities that will allow them to steal people's money. AI makes it possible for bad actors to be one step ahead. Developers will now need to be very careful with their releases, code changes and especially historical code reviews. AI can identify a few bad lines of code within tens of thousands of lines probably without much difficulty, but a small team of devs who do it manually will need to spend much more time on it.

It seems that there are things on Boltz that can be abused and they shut down as a precaution. I am sure they will be back one day.

[examplens]

They issued a warrant canary today.
If we were to read between the lines, something completely different may be at stake. They may have been compromised in another way, but they are restricted from disclosing it.

Code:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

The maintainer(s) and admins of the software project
known as Boltz Exchange have received and complied with 0
requests for information of any kind by any third parties
including but not limited to government agencies. We will
renew this notice in 60 days time. If this notice fails
to be renewed by then, you should assume the worst.

I am the admin of https://boltz.exchange
I am in control of my PGP key.
I will update this canary within 60 days.

Today is 2026-08-05.
Latest bitcoin block hash:
000000000000000000006b67852dfffa4e4f2d8f63751ca837417f3ac990cf7a
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEwmQPYwVw9e3t4C3mhNJJunFoXUYFAmpzNo4ACgkQhNJJunFo
XUbllg/+M0+FuAXaaWo2dc5z9Pa8ZRjPl9hQHeHufLdVZLIikF3jBBxGWKqmx/aw
vUTQd1FefPFCXB96bDsTh+BGQOsSiat1pheujP5yhUGVEbxWYYPsUSJLQNvwgUcl
v/Ghd7M/V3OuPXYhfrebAnlOQawOZrgqEL277wQC94TVBtPi7eEizWLJxCq1d0ze
NMpeaaiL/aFxv9pcGzGuuxzjNX3EcaW/Sc+PRaFzV6MmeClXEHGxRnpgAxAw4HFZ
nxHpy5P0PmZgsCZghzVgO7KiTYl/32ys/OB9O2DCm6UzmVSEMk0fei5jKxjF/rJk
aFfoPdqF7bCAEEZmHK6DQXxwatHPtBDOFdnWIpWHwBOC5paB7IC2EGyvrel11Zg4
XvGoE7XpU+ZqEPpGlzFvZ81Il58bszjcdjZOLY6rrBtOa/9m7l7/8alB0mHBtWL0
gSYgtXnL5wKi1YCdnkQHm8hegGCF5TH1OyEZ25VptDtpbtCLJ6dxlqV+BjLusvAq
Zm2WGyAKic8QqynMAHJtP/9QbtslfcW2NTs7rwgKkxuI8ZSlJikgpoIR3Z4rBRiU
N2rVTkK5by9uaD7bgok6XjkSD4kzet5dCsgfHkq2abTSvh2p2BzFvneqIWZt6mHL
Ynb+btwZxdU0fOYmF/7Aob9tIXwiqfwwcWulOYwIdLh+1GaeTRY=
=u4+b
-----END PGP SIGNATURE-----

https://canary.boltz.exchange/

[NotATether]

They issued a warrant canary today.
If we were to read between the lines, something completely different may be at stake. They may have been compromised in another way, but they are restricted from disclosing it.

Compromised for what? Absolutely zero Coldcard funds went through Boltz or through the Lightning Networks and the service was closed for days.

Or are governments now trying to dismantle Bitcoin by capitalizing on a mistake made by nvk and Coinkite?

This is literally 2023 all over again. Ugh

[Forsyth Jones]

Compromised for what? Absolutely zero Coldcard funds went through Boltz or through the Lightning Networks and the service was closed for days.

Or are governments now trying to dismantle Bitcoin by capitalizing on a mistake made by nvk and Coinkite?

This is literally 2023 all over again. Ugh

Many are in alarm mode due to these events involving coldcard (and now with boltz), for now, no other instant-exchange service is going through similar problems, it could actually be a hacker attack using IA and this letter is just a formality as a measure of additional transparency towards customers, yes, everything could be at stake and what you commented could make sense, like a witch hunt for non-KYC services...

[Pmalek]

Many are in alarm mode due to these events involving coldcard (and now with boltz), for now, no other instant-exchange service is going through similar problems

Coldcard and Boltz aren't the only two services that have had problems in the last few days. The ZEUS Lightning wallet is non-operational since yesterday or the day before yesterday. They say that they suffered a "a cybersecurity incident." Similarly to Boltz, they claim that user funds weren't lost and aren't at risk but they are auditing their systems. More information is available in their blog post.

[NotATether]

Coldcard and Boltz aren't the only two services that have had problems in the last few days. The ZEUS Lightning wallet is non-operational since yesterday or the day before yesterday. They say that they suffered a "a cybersecurity incident." Similarly to Boltz, they claim that user funds weren't lost and aren't at risk but they are auditing their systems. More information is available in their blog post.

So now that's two Lightning network providers not working at once 

[nc50lc]

They issued a warrant canary today.
If we were to read between the lines, something completely different may be at stake. They may have been compromised in another way, but they are restricted from disclosing it.

Is there any official news regarding the whereabouts of the compromised Coldcard funds?
I'd like to read it.

You're probably thinking that it may be similar to what happened to eXch like some of the compromised funds have been swapped via Boltz and the authorities are into them?
That's a valid and good reasoning but it needs some evidence to back it up.

[Pmalek]

Is there any official news regarding the whereabouts of the compromised Coldcard funds?
I'd like to read it.

There are reports that the hackers have started mixing/coinjoining the stolen coins. For example, there is this X post that talks about it.
Apparently, some of the bitcoin is being coinjoined through Wasabi Wallet and Kruw's coordinator. I also saw a post from ZachXBT who posted about wishing that Kruw rots in prison and losses everything he has. Something along those lines.

[avp2306]

Is there any official news regarding the whereabouts of the compromised Coldcard funds?
I'd like to read it.

There are reports that the hackers have started mixing/coinjoining the stolen coins. For example, there is this X post that talks about it.
Apparently, some of the bitcoin is being coinjoined through Wasabi Wallet and Kruw's coordinator. I also saw a post from ZachXBT who posted about wishing that Kruw rots in prison and losses everything he has. Something along those lines.

Also read an article about that action done by hackers https://www.analyticsinsight.net/news/coldcard-bitcoin-theft-splits-as-64-btc-moves-through-wasabi-mixer Maybe this article can help to gain more info about recent actions done by those criminals.

But as what has been said there majority of the funds remain untouched.

Most stolen Bitcoin linked to the Coldcard exploit remains unmoved, while a separate attacker has begun using CoinJoin. Investigators continue tracking flagged addresses. Users with affected seeds must create new wallets and transfer funds because firmware updates cannot secure compromised seed phrases.

It seems that the hackers still finding ways on how they can launder the money and move it without traces.

[examplens]

They issued a warrant canary today.
If we were to read between the lines, something completely different may be at stake. They may have been compromised in another way, but they are restricted from disclosing it.

Compromised for what? Absolutely zero Coldcard funds went through Boltz or through the Lightning Networks and the service was closed for days.

Or are governments now trying to dismantle Bitcoin by capitalizing on a mistake made by nvk and Coinkite?

This is literally 2023 all over again. Ugh

There was no connection with Coldcard, not even mentioned. They have been claiming for some time that they are having difficulty working, and AI attacks have been cited for this. This is an updated warrant canary where they added this part so that they are not under pressure from the government agency.
This is a perfidious way to send a message and still stay within the legal framework. We'll find out in 60 days.