On August 5, ZEUS halted operations of its Lightning wallet after discovering a cyber incident, becoming the third major Lightning service provider to suspend activities within approximately 72 hours following outages at Boltz and AQUA.
The company confirmed that the attack was neutralized and customer funds were not lost. However, the shutdown of three well-known Lightning-related services within a few days has raised concerns about the security of Lightning infrastructure providers, rather than the Bitcoin Lightning Network itself.
The broader cryptocurrency market showed no signs of concern. Bitcoin was trading around $64,600, down just over one percent. Thus, investor worries appear to be focused solely on the affected companies.
A Cluster of Lightning Services Goes Offline
ZEUS is the latest operator to suspend key services. The non-custodial Bitcoin bridge Boltz stopped processing swaps after detecting an AI-driven attack on its infrastructure on August 3. The company stated it maintained its API functionality for cooperative refunds and confirmed that unilateral refunds could be claimed without using its infrastructure.
Later that same day, AQUA Wallet reported unavailability of Lightning and Liquid swaps as the company sought alternative swap providers.
There is no evidence linking the cyber incident at ZEUS to the breaches at Boltz and AQUA, and ZEUS gives no indication of any connection. The only link between the three incidents is timing. All three prominent operators in the Lightning ecosystem suspended operations within three days, raising questions for users reliant on Lightning for fast and cheap Bitcoin payments.
Discussions among Lightning node operators on Reddit confirmed these concerns. However, many users noted that self-hosted and independently managed Lightning payment channels continue to function properly. Some users pointed out that the incidents highlight the advantages of self-custody features in Lightning and the need to limit reliance on centralized infrastructure.
What ZEUS Told Users About the Data Breach
In a recent security update released on August 5, ZEUS founder Evan Kaloudis stated the company shut down its infrastructure to conduct a comprehensive security audit.
ZEUS assured its customers on platform X that "customer funds were not lost and were not at risk."
Kaloudis stated that investigators found no evidence of a compromise of the Lightning node software, and the incident appears limited to ZEUS's infrastructure.
Clients whose liquidity service provider (LSP) channels were disconnected during the outage will receive replacement channels once service resumes. Since LSPs facilitate Lightning transactions by managing payment channels and providing liquidity for payments, their disconnection can halt payments but does not disable the protocol.
Furthermore, ZEUS strongly urged affected users to contact support via the "Help" section in the wallet, while warning that support response times may currently be increased due to the ongoing investigation.
In response to the incident, ZEUS is following the U.S. National Institute of Standards and Technology (NIST) cybersecurity guidelines, which advise efforts to contain the incident, verify the involved systems, confirm successful recovery, and complete post-incident analysis before resuming services.
Lightning Metrics Remained Largely Stable
Despite the recent outages, the analytics platform Lightning Amboss maintains that the network itself remains functional.
In a series of posts on X, the company stated that concerns primarily involve a few large players, not the broader Lightning network. It pointed to Boltz's swap suspension, ZEUS's infrastructure shutdown, and a reduction in the public capacity of the LNBiG network's Edge-1 node to zero.
Amboss stated that while Boltz was unavailable, other major Lightning swaps continued to show growth in activity. It also suggested LNBiG's capacity reduction may have resulted from a possible internal reallocation of funds, as two other LNBiG nodes saw increased capacity on the same day, although confirmation from the operator is still pending.
According to the company, Lightning Network capacity continues to grow, despite a slowdown in public channel creation, indicating a preference for private channels. The company also stated that Wallet of Satoshi's shift to self-hosting is further evidence of the network architecture's evolution, not a sign of declining demand.
As noted by Amboss, the Lightning Network has approximately 14,760 public nodes, 43,900 public payment channels, and a stated capacity of 4,522 $BTC.
During the same week as the August 6 incidents involving Boltz, AQUA, and ZEUS, public capacity actually increased by 28 $BTC (0.61%), and the number of public payment channels grew by 256 (0.59%); meanwhile, the number of public nodes decreased by only 108 (0.73%). This indicates that the events affected only certain providers and do not signal a broader abandonment of Lightning.
What's Next for ZEUS?
According to ZEUS representatives, this event will only strengthen measures to improve security. In April 2026, the company successfully completed a SOC 2 Type II audit conducted by Prescient Assurance. It was through this audit that ZEUS realized the importance of using Trusted Execution Environments (TEEs) and the Validating Lightning Signer (VLS) project to achieve its long-term security goals.
The VLS project helps separate Lightning signing keys from node software, thereby limiting the ability to perform channel operations without authorization, even if the node is compromised.
Currently, users await ZEUS's completion of the security assessment, restoration of normal service operations, and a decision regarding the replacement Lightning channels previously promised to affected clients.
