Zeus Wallet pulled its Lightning Network nodes offline early Tuesday after detecting unauthorized access to internal infrastructure. Founder Evan Kaloudis posted on X that no customer funds were lost and the Lightning protocol itself was not compromised. The wallet, which lets users self-custody bitcoin over Lightning, serves an estimated 15,000 monthly active users across iOS and Android.
How the breach unfolded
Attackers gained access to Zeus's cloud-hosted Lightning node management plane — not user seed phrases or on-chain keys. Kaloudis said the breach was contained to operational tooling that manages channel liquidity and routing policies. No private keys left user devices. The team rotated all infrastructure credentials and revoked API tokens within two hours of detection.
The compromised layer handled channel rebalancing and fee estimation — operational functions that keep Lightning channels balanced and cost-efficient. This separation of concerns is by design: signing keys never leave user devices, while the cloud infrastructure manages the complex routing logic that makes Lightning payments reliable. Even a full infrastructure compromise could not extract user funds without physical device access, a property that distinguishes self-custodial architectures from custodial alternatives.
Where the funds went
Zero bitcoin moved from user wallets. On-chain analysis from Glassnode shows no unusual outflows from Zeus-associated UTXOs during the incident window. The wallet's architecture keeps signing keys on-device; the compromised layer only handled channel rebalancing and fee estimation. Kaloudis emphasized that even a full infrastructure compromise could not extract user funds without device-level access.
Bitcoin traded at $64,575 during the incident, up 0.7% in 24 hours with total crypto market cap at $2.28 trillion. The Lightning network's total capacity stood at 5,432 BTC across all nodes, per 1ML.com, providing context for the scale of Zeus's operations within the broader network. Zeus's estimated 15,000 monthly active users represent a small but meaningful segment of Lightning's retail user base, particularly among mobile-first bitcoin holders who prioritize self-custody.
Response and restoration
Zeus paused all automated channel management and disabled its LSP (Lightning Service Provider) endpoints. The team is restoring services in phases: read-only node monitoring first, then manual channel operations, finally automated routing. Kaloudis said a full post-mortem will publish within 72 hours. No ransom demand was received.
The phased approach reflects the operational reality of Lightning infrastructure. Read-only monitoring allows the team to verify channel states and network topology before re-enabling any write operations. Manual channel operations give users direct control while automated systems remain offline. Only after validating both layers will automated routing — the LSP's core value proposition — resume. This methodical restoration prioritizes certainty over speed.
User impact and exposure
Active channels remained open on-chain throughout the outage. Users could still receive payments but could not initiate new ones via Zeus's LSP. The wallet's fallback to direct peer connections preserved basic send/receive for technical users. Kaloudis advised against third-party recovery tools claiming to restore Zeus channels.
This is the first notable infrastructure breach at a consumer Lightning wallet since Breez's 2023 API incident. Competing wallets Phoenix, Breez, and Mutiny all run similar LSP architectures, relying on centralized liquidity services to abstract Lightning's complexity for end users. The event renews debate over custodial trade-offs in "self-custodial" products that depend on centralized infrastructure for liquidity management. Bitcoin's 56.7% market dominance held steady during the news cycle, suggesting the market viewed this as an operational incident rather than a protocol-level threat.