Swiss Bitcoin Pay has been compromised

[ryzaadit]

Today, Swiss Bitcoin Pay created a post someone just gained access to Swiss Bitcoin Pay’s internal systems. Right now they decide to stop the service and tried to investigated the issue first.

What's the data taken by the access:

• Emails
• BTCitcoin address
• TX history
• Hashed password
• International Bank Account Number

They also don't have any other information for the other data has been taken. Anyone who use these service, tried to be carefull cause you can get a scam target.

Swiss Bitcoin Pay fund are safe, and any amount will be refunded. Until now, there is no further information when they're gonna to open the service again.

Source: https://x.com/SwissBitcoinPay/status/2099473448162488618

[Zlantann]

It's good to know that Swiss Bitcoin Pay discovered this breach on time and took necessary precautions. Another good piece of news is that people's funds are safe. However, these criminals now have access to some important personal information. Users' identities have been exposed and could be sold on the dark web market. Those who use the services of this non-custodial payment processor and gateway company would have to be ready for all forms of phishing messages.

I also hope they reopen soon so that users will have access to their funds.

Thanks for sharing.

[Emitdama]

It's good to know that Swiss Bitcoin Pay discovered this breach on time and took necessary precautions. Another good piece of news is that people's funds are safe. However, these criminals now have access to some important personal information. Users' identities have been exposed and could be sold on the dark web market. Those who use the services of this non-custodial payment processor and gateway company would have to be ready for all forms of phishing messages.

Phishing messages are not that big of an issue in my opinion, but there is one more thing that the users need to be worried about, it is the attackers cross-checking the hashed passwords and emails they have stolen at every possible platform and service in the hope that they might find a match and get access to user accounts where they can possibly do some stealing. For example, if a merchant who was using Swiss Bitcoin Pay also has a Binance account with the same email address, and it is a fact that a lot of people usually use the same password for most of the accounts they hold so that they don't forget the password easily, which means that if they try, they might be able to log in.

I used Binance only as an example, and I know that Binance has good security because they ask for 2FA, and they also sometimes asks for facial verification when a new device tries to log into an account, which is a great thing, but I'm just generally talking about possibilities. So I think that every single user should immediately change the passwords of any other platform and service they use where they are using the same email addresses which they have used for Swiss Bitcoin Pay accounts so that the attackers or malicious users don't get to have any possibility of stealing any of their funds.

[MisFoxie]

It seems that their company is very small so their database should also be very small. They have an app on the Play Store and judging by its reviews it doesn't seem like a very good project. I don't think anyone on the forum would ever use an app like this.  Please verify it before opening a topic.

[OgNasty]

Not saying this is the case here, but whenever there are bear markets it seems to show who has been operating without the proper reserves.  Most companies tend to cover this fact by claiming hacks or bugs that lose funds...  Again, not saying that is what happened here, I have no idea.  I am seeing an uptick of this sort of thing though and while it is fun to blame AI (the scapegoat of the day), the reality is that more hacks come from the inside than anyone would be willing to admit.

[Upgrade00]

Phishing messages are not that big of an issue in my opinion, but there is one more thing that the users need to be worried about, it is the attackers cross-checking the hashed passwords and emails they have stolen at every possible platform and service in the hope that they might find a match and get access to user accounts where they can possibly do some stealing.

Their first target will be to get into the email address, if the hashed password is similar to the one used to open it. Any financial account they try to access will send an otp to the email even if they get the credentials correct. With the email they can get access to that account or any other one opened with it.

With the rate of data breaches crypto users should consider having an email address for a particular service, not using one to open multiple accounts to reduce the risk if that data gets to the wrong hands.

[Donneski]

The good thing is that they have a working technical team who were able to quickly spot the breach and immediately secured the funds of their customers. However, the fact that their data have been leaked should still a big concern. An email address and transaction history getting exposed might not have immediate negative effect but they can be used as good tool for phishing scam moves as the information can be misleading. So for their customers, they'll have to be extra careful with messages they receive going forward especially the ones that'll ask for their log in details or ask they they verify something.

[Odogwu-Blockchain]

This kind of hack incident usually happens through the worker in the company knowingly or unknowningly giving the user access to penetrate into the system. If hacker gets into the system then the next step is withdrawing crypto which the teams knows someone is in the system.

What I find more interesting is the refund the brand promised to whoever may falls victim if such incident occurs, and that's the biggest flex and feeling a company should exhibit towards their customers.

[Rashlyowl]

With over 1,000 merchants across 21 countries, 5,000,000 Swiss Francs have been transacted. Data is the new oil, I think the hacker has already obtained what he wanted. In the end, it is the original BTC that has never been hacked, but scammed at the layer involving centralized sites.

[tabas]

What's the data taken by the access:

• Emails
• BTCitcoin address
• TX history
• Hashed password
• International Bank Account Number

~

Swiss Bitcoin Pay fund are safe

Funds are safe but the data that has been leaked and copied by the hackers are no longer safe. It's already out of their jurisdiction and I agree to emitdama that the risk is on the users by having the same passwords with their swiss bitcoin pay accounts and other details that can be the same to other financial and crypto exchange accounts that can be cross examined by the hackers. If they have the same login details for usernames and passwords, that's the problem they have to deal with because hackers could dig deeper and keep on testing these details until they hit the same login details for different platforms that contains balances.

[EluguHcman]

I guess lot of crypto users might not be too familiar with this Swiss Bitcoin Pay, it is notable to be one of the famous services that profers the means of merchants whether on-line or off-line dealers to accept and make Bitcoin payments.
It is a lightning network but not like the exchange where users may use as a trading services platform.

The companys management team seem to also be effective by quickly interfering with the drastic measures of taking down the service server so that they can intercept the operations of the scammers before victims maybe counted.
And to keep users unpanic is why they have also promised to refund customers who may have count lost of their funds over the incident of the network security being breached with all diligent efforts providing how effective and concerns they are of their customers.

As the information has also been revealed, it is better anyone using the service to stay aware and skeptic just in case the attackers may have come to contact you via the datas of users listed that they stole.