Back
ZEUS takes infrastructure offline after cyber incident, says no customer funds lost

ZEUS takes infrastructure offline after cyber incident, says no customer funds lost

The self-custodial Lightning wallet said the attack was contained within hours, no funds were exposed, and replacement LSP channels will follow an audit, as Bitcoin developers widen reviews after the Coldcard attacks.

BTC

Fact Check
The core claim is directly confirmed by ZEUS's own security-update blog and official @ZeusLN X post: infrastructure taken offline after a mitigated cybersecurity incident, with no customer funds lost or at risk, and the incident limited to ZEUS infrastructure (not Lightning node software). The surrounding framing—a three-day cluster of Lightning-linked provider disruptions (Boltz, AQUA) with the Lightning Network itself remaining stable—is supported by Cryptopolitan and cryptonews.net citing Amboss network data showing public capacity and channel counts rising slightly. Multiple independent outlets (KuCoin, Binance Square, Odaily) echo the same facts, and no conflicting evidence was found.
Summary

ZEUS took infrastructure behind its self-custodial Bitcoin Lightning Network wallet offline after containing a cybersecurity incident within hours, saying no customer funds were lost or put at risk and that investigators have found no evidence of a vulnerability in Lightning node software. Founder Evan Kaloudis said the incident appears limited to ZEUS infrastructure, and users whose Lightning Service Provider channels were closed during the outage will receive replacement channels once operations resume. The company has not disclosed how access was gained or when services will return. The outage followed ZEUS's earlier suspension of swap functionality after non-custodial Bitcoin swap provider Boltz halted its platform, though the company has not indicated the events are linked. ZEUS said the episode reinforces its work on trusted execution environments, or enclaves, and the Validating Lightning Signer project. The disruption also comes as the volunteer-led Bitcoin Red Team expands AI-assisted security reviews after the recent Coldcard wallet attacks, which Galaxy Research said have resulted in 1,596 BTC in confirmed thefts across roughly 7,300 addresses.

Terms & Concepts
  • Lightning Service Provider: A service that helps users open Lightning channels and access routing liquidity.
  • trusted execution environments: Hardware-isolated computing environments, also called enclaves, designed to protect sensitive code and data.
  • Validating Lightning Signer: A tool that separates Lightning signing keys from node software to reduce the risk of unauthorized channel actions.