ZEUS pulls infrastructure offline after hack, third Lightning outage in a week

On August 5, ZEUS brought its Lightning wallet services to a halt following the discovery of a cybersecurity incident, making it the third prominent Lightning provider to suspend its services within a period of about 72 hours following service interruptions at Boltz and AQUA.

The company has confirmed that the attack was dealt with and no customer money was lost. However, three well-known services that are related to Lightning going offline within days of one another has raised concerns about the safety of Lightning infrastructure providers, not of the Bitcoin Lightning Network itself.

The wider cryptocurrency market did not really show any signs of concern. Bitcoin was trading at around $64,600 on August 6th, down just over one percent as per CoinMarketCap. Hence, concerns of the investors seem to be directed solely towards the affected companies.

A cluster of Lightning services going dark

ZEUS is the latest operator to pause key services. Non-custodial Bitcoin bridge Boltz stopped processing swaps after the detection of AI-assisted attack on its infrastructure on August 3. The company said it kept its API operational for making cooperative refund and affirmed that unilateral refunds could be received without using its infrastructure.

Later that day, AQUA Wallet shared the news of the unavailability of Lightning and Liquid swaps as the company looked for other swap providers.

There is no proof linking the cyber incident at ZEUS to the disturbances at Boltz and AQUA, and there is no indication from ZEUS of any connection. The only point of connection between the three incidents is the timing. All three well-known operators in the Lightning ecosystem suspended essential operations in a span of three days, raising questions among users depending on Lightning for quick and cheap Bitcoin payments.

Discussions of Lightning node operators on Reddit have confirmed those worries. However, many users made a point that self-hosting and independent management of Lightning payment channels were still functioning as intended. Certain users pointed out that the incidents proved the advantages of the self-custodial feature of Lightning and indicated a need for limiting dependency on centralized infrastructure.

What ZEUS told users about the breach

In a recent security update released on August 5, ZEUS founder Evan Kaloudis declared the company had taken its infrastructure offline to conduct a comprehensive security audit.

ZEUS reassured its customers on X that “customer funds were neither lost nor at risk.”

Kaloudis stated that investigators have not found any proof that the Lightning node software was compromised and the incident seems to be limited to the infrastructure of ZEUS.

Customers whose Liquidity Service Provider (LSP) channels are terminated during the downtime will obtain substitute channels when operations resume. Since LSPs facilitate Lightning transactions by managing payment channels and providing liquidity for payments, taking them offline may stop payments, but it will not disable the protocol.

In addition, ZEUS has urged the affected users to reach out to the support team using the Help section of the wallet, although it warned that the response time of the support team may take longer at this point in time due to ongoing investigations.

In its response to the incident, Zeus adheres to the U.S. National Institute of Standards and Technology (NIST)’s cybersecurity recommendations that advise making efforts to contain the incident, to review the systems involved, to check whether the recovery is successful, and to complete the analysis of the post-incident situation before the resumption of services.

Lightning metrics remained broadly stable

Despite the recent disruptions, Lightning analytics platform Amboss says the network itself remains healthy.

Through a series of X posts, the firm stated that worries are mostly based on a few high-profile players and not the wider Lightning network. Boltz’s halting the swaps, ZEUS putting its infrastructure offline, and LNBiG’s Edge-1 node reducing its public capacity to nil were all pointed to by the company.

Amboss stated that while Boltz was offline, other big Lightning exchanges were seeing continued growth in their operations. It also suggested that the cut in the LNBiG’s capacity was a result of a possible internal fund reallocation as there were two other LNBiG nodes whose capacities were actually increased on the same day, although there has not been any confirmation of that from the operator.

According to the company, the Lightning Network’s capacity continues to increase even though the creation of public channels is slowing down, indicating a preference for private channels. It further stated that the transition of Wallet of Satoshi to self-custody is yet another demonstration of the evolution of network architecture rather than an instance of its declining demand.

As noted by Amboss, the Lightning Network has around 14,760 publicly accessible nodes, a count of 43,900 public payment channels, and a publicly declared capacity of 4,522 BTC, as of August 6.

During the same week covering August 6, which saw the Boltz, AQUA, and ZEUS incidents, public capacity actually increased by 28 BTC (0.61%), while the number of public payment channels grew by 256 (0.59%); at the same time, the number of publicly accessible nodes dropped only by 108 (0.73%). This means that the events were limited to certain providers and do not mean a more general retreat from Lightning.

What comes next for ZEUS

According to ZEUS, this event will only bolster the security improvements that they have already started. In April 2026, the company successfully completed the SOC 2 Type II audit performed by Prescient Assurance. It was during this audit that ZEUS discovered the importance of using Trusted Execution Environments (TEEs) and the Validating Lightning Signer (VLS) project in achieving its long-term security goals.

The VLS project helps to separate Lightning signing keys from the software of the node, thus limiting the possibility of channel operations being performed without authorization, even in case the node becomes compromised.

At the moment, users are waiting for ZEUS to complete its security assessment, restore normal operation of its services, and reach a decision regarding the replacement Lightning channel previously promised to affected customers.

The smartest crypto minds already read our newsletter. Want in? Join them.