Swiss Bitcoin Pay takes servers offline after data breach

Swiss Bitcoin Pay, a non-custodial bitcoin payment processor based in Neuchâtel, Switzerland, said it temporarily shut down its servers Monday after detecting a data breach that may have exposed customer email addresses, bitcoin addresses, IBANs, transaction histories and hashed passwords.

The company said a malicious user had likely gained access to its internal systems and that, as a precaution, it took its infrastructure offline while it investigates and secures the network. Swiss Bitcoin Pay said user funds are safe and that any amounts owed to users will be fully returned. The company did not immediately respond to a request for comment.

Swiss Bitcoin Pay said its investigation is ongoing and that it has not yet determined whether additional categories of information were accessed. The company has not disclosed how many accounts were affected, when the unauthorized access began, whether data was actually taken, or how the attacker gained access. No restoration timeline has been announced.

Swiss Bitcoin Pay lets merchants accept bitcoin payments through on-chain transactions and the Lightning Network via a mobile app, web dashboard, e-commerce integrations and an API. The company said its non-custodial structure, which immediately transfers bitcoin received by merchants to wallets controlled by customers rather than holding it, means the breach is isolated from customer fund custody. No evidence of unauthorized bitcoin transfers has been presented, and no losses tied to the breach have been confirmed. For customers using bank payouts, the service automatically converts bitcoin proceeds into fiat currency, a process that requires banking information such as IBANs.

Security researchers have noted that combining email addresses with transaction histories and financial identifiers gives attackers enough detail to launch targeted phishing or impersonation attempts against specific individuals.

The incident adds to a series of recent breaches at bitcoin and fintech firms. Revolut confirmed last week that it had handed customer passports, driver’s licenses, verification selfies and transaction histories to an unauthorized party that sent fraudulent requests using a legitimate government agency’s email domain. Hardware wallet maker Trezor also warned last week that a breach at a third-party marketing platform it uses for newsletters exposed contact information and shipping records for tens of thousands of customers and was being used to target them with phishing attacks.

In January, scammers used a breach at Ledger’s payment processor Global-e to obtain customer information for phishing emails, and crypto wallet provider SafePal disclosed last month that unauthorized access to an order-tracking plugin exposed order information, including names, addresses and purchase data, for about 39,798 customers. Swiss Bitcoin Pay has not linked its breach to any specific application or vulnerability.