Swiss Bitcoin Pay has temporarily taken its servers offline after a suspected unauthorized actor accessed its internal systems, potentially exposing customer contact, banking and transaction information.

The Bitcoin payments provider disclosed the security issue on September 14. It said user funds remain safe while the company investigates the access and secures its infrastructure. Swiss Bitcoin Pay has not announced when its services will resume.

Emails, Bitcoin Addresses and IBANs May Have Been Exposed

The information potentially accessed includes customer email addresses, Bitcoin addresses, IBANs, transaction histories and hashed passwords. The investigation has not determined whether additional categories of information were reached.

Swiss Bitcoin Pay has not disclosed how many accounts may be affected, when the unauthorized access began or whether data was copied from its systems. It has also not identified the access method or the party responsible. The technical cause therefore remains unresolved as the investigation continues.

A combination of email addresses, transaction histories and financial identifiers could provide an attacker with detailed information for targeted impersonation or phishing attempts. Similar risks emerged after a recent Trezor customer-data breach exposed contact and shipping records belonging to tens of thousands of hardware-wallet buyers.

Swiss Bitcoin Pay Uses a Non-Custodial Payment Model

Swiss Bitcoin Pay operates a merchant payments service that supports Bitcoin transactions through both Lightning and onchain payments. Its merchant system is designed to transfer received Bitcoin to wallets controlled by customers instead of retaining the assets under long-term company custody.

Merchants can accept payments through the mobile application, web dashboard, e-commerce integrations and an API. Swiss Bitcoin Pay also supports automatically converting Bitcoin receipts into fiat for customers who use bank payouts, a process that requires banking information such as IBANs.

The company’s disclosure distinguishes the suspected systems access from customer-fund custody and states that funds remain safe. It has not published evidence of unauthorized Bitcoin transfers or identified any loss amount connected to the intrusion.

Servers Remain Offline During Security Review

Swiss Bitcoin Pay took its infrastructure offline as a precaution rather than continue operating while it determines the extent of the access. The company has not published a technical root cause, remediation timeline or service-by-service schedule for restarting operations.

The disclosure follows other customer-data security cases in the crypto sector, including a recent SafePal order-data exposure involving 39,798 customers. SafePal attributed that separate incident to an authorization flaw in an order-tracking plug-in. Swiss Bitcoin Pay has not yet linked its suspected compromise to a specific application, dependency or vulnerability.

Swiss Bitcoin Pay remains offline, and no reopening date has been provided. The company said any amounts currently owed to users will be returned in full while it works to secure the affected infrastructure.

Source: Crypto Adventure