Swiss Bitcoin Pay has been compromised

[Zarya Volk]

Snip

Importantly, your Bitcoin is safe. Unlike other payment processors, Swiss Bitcoin Pay is a non-custodial service. Meaning they don’t hold onto users’ Bitcoin. Payments are sent to merchants’ Bitcoin addresses directly. Therefore, there is no way for the hacker to drain your Bitcoin, despite having full access to their server.

This is unlike previous crypto-related hacks like the $320M Liquid Network hack and the theft of 267K XRP where the respective platforms did hold onto their users’ assets.

But this hack is still bad. It’s important to be on your toes in case someone uses their newfound knowledge about your IBAN, Bitcoin addresses, transactions, and other financial dealings to verify themselves as Swiss Bitcoin Pay via DM and steal your credentials, convince you to reset your password, or steal a 2FA code. Similar tactics were seen during the Trezor hack and Solana Mobile hack earlier this year.

Swiss Bitcoin Pay is considered a financial intermediary under Swiss anti-money laundering (AML) law. As such, the company is required to notify users and the Swiss data protection regulator (FDPIC) if a data leak meets certain requirements. It’s not clear if either has happened.

As for what to do? Make sure to change your Swiss Bitcoin Pay password everywhere else you may have used it and ignore anyone who messages you claiming to be Swiss Bitcoin Pay employees.

[bitLeap]

I am concerned that the data that has been leaked is being traded and thieves are coming to people's homes and forcing victims to give up access to crypto assets as has been the case in many European countries. Although the Swiss Bitcoin Pay claims the funds are safe but the leaked data is already in the hands of thieves who can at any time be used for offline crimes. Remember “funds are safe" but not the same as "owners are safe.”

[snowpega]

...
Swiss Bitcoin Pay fund are safe, and any amount will be refunded. Until now, there is no further information when they're gonna to open the service again.
...

Just checking on it more, I found out that Swiss Bitcoin Pay is an Intermediary platform run by Swiss authorities.
 And this means its system is not working like a traditional banking system or a centralized system. Now I am thinking how will they componsate its users because they only hold users' data, not any amount. Whatever amount or payment is transferred to any merchant is transferred directly to their accounts, where it provides its intermediary service to many other businesses all across Switzerland, if I am not wrong.

After reading your shared screenshot, it is already clear that users' and victims' funds are safe.
What I understand now is that they will compensate all the victims because whatever data is stolen or hacked is because of their mistake. And all the merchants and their users are safe. CMIIW!

[EstherBtc]

I like the fact that swiss bitcoin pay is transparent and accountable, they have assured their users that their funds are safe so far.

Also, this attacks calls for cyber security awareness because crypto platforms and sites have their own security protocols yet the end users also have a responsibly to secure and ensure their digital asset is secured.
1. Don't use easy and generic passwords
2. Use different passwords for different platforms and sites
3. In case of a breach change your password
4. Use MFA's or 2 Factor verification

[Hazink]

It seems that their company is very small so their database should also be very small. They have an app on the Play Store and judging by its reviews it doesn't seem like a very good project. I don't think anyone on the forum would ever use an app like this.  Please verify it before opening a topic.

You don't have to conclude and judge. The app and the company being very small does not mean anyone here might not have used it. They have 1k plus downloads on their playstore, enough to warn 1,000 about it. Any security bridge is a thing of concern to all, even if one don't personally use it they can know someone who does, so the topic is not something to ask the op to verify before creating, and the screenshot you shared I don't seem to see any single review on the said app on play store which I got directly from their official website page.

[Adiljutt156]

I am concerned that the data that has been leaked is being traded and thieves are coming to people's homes and forcing victims to give up access to crypto assets as has been the case in many European countries. Although the Swiss Bitcoin Pay claims the funds are safe but the leaked data is already in the hands of thieves who can at any time be used for offline crimes. Remember “funds are safe" but not the same as "owners are safe.”

The development of technology is bringing many features that are helping in life and also giving good satisfaction, but with this development now fears are also increasing because people are feeling unsafe; their sensitive information is leaking, and hackers can create threats for them anywhere. Hopefully companies and technology will be able to give good protection, but having phishing emails and messages is also troubling in case people are going to engage with them.

Few companies are taking this as priority to never give up and also keep things under good security but hackers and scammers are also working on their ways of having more advance things to enter and leak all for their own interest this war is not going to be end in near future because peoples needs this technology which also needs enough workout for security.

[Davidvictorson]

Today, Swiss Bitcoin Pay created a post someone just gained access to Swiss Bitcoin Pay’s internal systems. Right now they decide to stop the service and tried to investigated the issue first.

What's the data taken by the access:

• Emails
• BTCitcoin address
• TX history
• Hashed password
• International Bank Account Number

They also don't have any other information for the other data has been taken. Anyone who use these service, tried to be carefull cause you can get a scam target.

Swiss Bitcoin Pay fund are safe, and any amount will be refunded. Until now, there is no further information when they're gonna to open the service again.

Where does this leave us and what lessons are there to be learned here.
1. Again not your keys, not your coins. The explanation that they would return whatever money is lost, still doesn't take away the key message.
2. Again, there will always be hackers so if you get an offer that it is too good to be true, the individual is most probably dealing with a hacker.
3. These hacks only goes to show that most if not all of these organizations, need to pressure test their systems to find vulnerabilities.

[Agathamay]

Thanks for the information mate and this is indeed helpful and should be take cognizance especially for those make use of the site and this is one issue people face while using centralized platforms and remember that even if the site said that's, users funds are safe, we should not forget that, there was still no exact date and time they will be reopen which also deserve attention.

It seems that their company is very small so their database should also be very small. They have an app on the Play Store and judging by its reviews it doesn't seem like a very good project. I don't think anyone on the forum would ever use an app like this.  Please verify it before opening a topic.

You don't have to conclude and judge. The app and the company being very small does not mean anyone here might not have used it. They have 1k plus downloads on their playstore, enough to warn 1,000 about it. Any security bridge is a thing of concern to all, even if one don't personally use it they can know someone who does, so the topic is not something to ask the op to verify before creating, and the screenshot you shared I don't seem to see any single review on the said app on play store which I got directly from their official website page.

Exactly I agree with you and even if he think, we might not have people who use it over here, there would still be chances that, we might also know people who might be using it .

[X-ray]

Swiss Bitcoin Pay claiming to be non-custodial



The question remains for everyone, then why are they claiming the fund is secure (or that some funds are being protected and perhaps being recovered in case someone who losses some funds from the accident).

Their answer:

We automatically batch all incoming lightning transactions to 1 onchain UTXO daily/weekly/monthly, which explains why we temporarily hold some user funds on our platform. Generally, these are not significant amounts.

Not sure about how much is being held, but it's not sound non-custodial for me.

This is from their website

In any case, you will receive your Bitcoin directly on your company's bitcoin wallet. automatically, without any intervention from you.

The custodial part is when you already receive your Bitcoin in your connected hardware wallet (?), and if their transactions batching that happens daily/weekly/monthly is true, it isn't very non-custodial then, the bitcoin is at custodial posession for quite sometime.

A non custodial should be when Bitcoin is sent to merchant upon transaction completion and the Bitcoin shouldn't be on their hand for brief period. On top of that their statement "any amount will be refunded" indicate that it's a custodial service.

The non custodial part seems a bit misleading indeed or they haven't comitted to true non-custodial yet.

[ryzaadit]

-snip-
The non custodial part seems a bit misleading indeed or they haven't comitted to true non-custodial yet.

Same, feeling misleading while they're claiming to be non-custodial.
Other people in the comments are having the same thought regarding non-custodial part. By the way, have you found any information regarding their Lightning Payment processing work? For the merchant.

[aoluain]

User funds are safe, and any funds owed will be fully returned

Thats funny, I'll bet they were saying the same thing about funds being safe up to the point
that they actually werent.

Is it my imagination in thinking that scams and breaches on third party platforms are becoming
more and more frequent?

Again it just goes to show while using these platforms we are really taking their word for it
when they say "your funds are safe with us".

[ryzaadit]

Thats funny, I'll bet they were saying the same thing about funds being safe up to the point
that they actually werent.

I bet, since they're handling the lightning payment daily/weekly/monthly of their merchants. The fund is being held by them are not too many; that's why they say those line. But in the end, the claim to be non-custodial remains being questioned.

Is it my imagination in thinking that scams and breaches on third party platforms are becoming
more and more frequent?

Perhaps due to the AI-slops check? It's easier to exploited find more issues or breaches. Just take an example from Cold Card tragedies; once these breach vulnerabilities happen. A volunteer group, Bitcoin Red Team, with the help of AI checks, found out:

• 4,962 security issues
• 720 marked as high-risk

Just needed 30 hours of work to find all of these.

[Sobz]

-snip-
The non custodial part seems a bit misleading indeed or they haven't comitted to true non-custodial yet.

Same, feeling misleading while they're claiming to be non-custodial.
Other people in the comments are having the same thought regarding non-custodial part. By the way, have you found any information regarding their Lightning Payment processing work? For the merchant.

I tried to make findings about how their non-custodial works but i didnt get enough information like i expected. But what I l tried to understand about swiss bitcoin pay is that they dont keep bitcoin for customers. If a customer wants to make payment they only recieve the money from customers and send to the merchant.  This is why when the hackers broke into it, they never saw bitcoin, the only thing they got was the information of customers. Swiss Bitcoin Pay may not be truly non custodial but just claim for customers to get their interest.

[ryzaadit]

I tried to make findings about how their non-custodial works but i didnt get enough information like i expected. But what I l tried to understand about swiss bitcoin pay is that they dont keep bitcoin for customers. If a customer wants to make payment they only recieve the money from customers and send to the merchant.  This is why when the hackers broke into it, they never saw bitcoin, the only thing they got was the information of customers. Swiss Bitcoin Pay may not be truly non custodial but just claim for customers to get their interest.

Searching their policy, and seem they're claiming to be non-custodial just because they're not holding or storing their merchants' funds or payments for such a long time. They used:

• Direct routing
• They act only as a relay payment

I've been asking these with their AI agents on Swiss Bitcoin Pay website.

[Zoomic]

In the past two months we've witnessed security and data breach involving Coldcard, Trezor and now,  Swiss Bitcoin Pay. For Swiss Bitcoin Pay, no funds were lost but personal data has been exposed which has the potential of creating serious problems to affected users.

Attackers will likely use the exposed emails, transaction history and every other vital information to try scam people through convincing phishing attempts.

While we await the full investigation to clarify us on in the information the attackers were able to access, it's important for their customers to be very cautious of how they respond to emails especially the ones pose as customer care asking they click a link or share additional information

[Sulegzy39]

Technological growth is providing many aspects that are useful in life and provide pleasant happiness, but it is also growing anxieties since individuals feel insecure; their private data is being compromised, and hackers can pose dangers to them from everywhere. Ideally, organisations and tech will be able to provide sufficient security, but having fraudulent emails and texts is also concerning in case consumers interact on these.

A few businesses are prioritising never giving up or maintaining good security, but scammers and hackers are additionally working on ways to have more advanced things to get into and leak all for their own benefit. This war will not end in the near future since humans need this kind of technology, which also requires proper security training.

[Alphakilo]

In the past two months we've witnessed security and data breach involving Coldcard, Trezor and now,  Swiss Bitcoin Pay. For Swiss Bitcoin Pay, no funds were lost but personal data has been exposed which has the potential of creating serious problems to affected users.

Attackers will likely use the exposed emails, transaction history and every other vital information to try scam people through convincing phishing attempts.

While we await the full investigation to clarify us on in the information the attackers were able to access, it's important for their customers to be very cautious of how they respond to emails especially the ones pose as customer care asking they click a link or share additional information

It's quite alarming how data risk has become a major concern for even non-custodial platforms these days. I wonder what will become our fate when quantum computers come onboard and hacks become more predictable because it seems these platforms just go into business without ever thinking about the possibility of hacks, such that they do so much to test and retest their systems before allowing users onboard. This could be an internal concern instead of always blaming hackers.

Users should try as much to change the password they use on this Swiss Bitcoin pay, and any other platforms and services to endure they are safe and treat every email notifications as a phishing or scam email just to be safer.

[joniboini]

I wonder what will become our fate when quantum computers come onboard and hacks become more predictable because it seems these platforms just go into business without ever thinking about the possibility of hacks, such that they do so much to test and retest their systems before allowing users onboard.

Worst case scenario for businessess would be the number of customer decrease as they move to more privacy focused platforms. I find that unlikely though, given that a lot of people like convenience even if it might risk their private data. Unless they become a victim, it's pretty unlikely they'll change their habits (which means if a disastrous case happened, a lot of people might change their habits). Of course I hope things will change in the near future, especially with the advance of tech and whatnot.