Swiss Bitcoin Payments claims there is no evidence that merchants have Bitcoin wallets...

The story of a security incident encountered by the Swiss Bitcoin Payment Platform

Swiss Bitcoin Pay temporarily shut down its server after detecting possible unauthorized access to its internal system. The move led to the disruption of Bitcoin payment services, and the company is investigating the matter and strengthening infrastructure security. The Swiss-based payment service provider disclosed the security incident on September 14.

Sensitive information that may be affected includes: customer email addresses, Bitcoin addresses, IBAN (international bank account numbers), transaction history, and password hashes. So far, the company has not disclosed how the attacker gained access, nor has it said how many customers may have been affected, or whether the potentially accessible information mentioned above has actually been copied. In addition, the company did not give a specific timetable for restoring the server.

Despite this, the company stated that customer funds are still safe and that all amounts currently owed to users will be refunded in full. There is currently no indication that the merchant's private key was compromised, nor is there any evidence that Bitcoin was removed from the customer's self-managed wallets through this incident.

Importance of unmanaged model

The operating model of Bitcoin payments in Switzerland is different from that of traditional managed crypto asset exchanges. Its payment service is designed to ensure that bitcoins received by merchants end up in wallets controlled by merchants, rather than being controlled by companies for the long term. The platform supports Bitcoin and Lightning Internet payments through mobile apps, online dashboards, e-commerce integrations and APIs. Merchants can choose to retain Bitcoin receipts or automatically convert them into fiat currency and transfer money through the banking system.

This architecture helps reduce financial losses caused by damage to internal systems, because even if an attacker invades the company's system, he may not be able to obtain the merchant's private key or the centrally stored customer Bitcoin pool. However, there are still certain risks within the payment process. Swiss Bitcoin Payments explained that incoming Lightning Network payments may temporarily stay in its system and then be merged into on-chain bitcoin output according to a daily, weekly or monthly plan. The company stated that these temporary deposits are usually limited and amounts owed to customers will be repaid.

Investor revelation and potential risks of data breaches

While self-custody may limit the risk of direct theft of Bitcoin to a certain extent, this incident shows that non-custody payment companies still hold high-value financial and identity data. For merchants, security risks are not limited to private keys, but also include identification information that connects customers, bank accounts, and blockchain transactions.

If the investigation confirms that customer records were extracted, the potential exposure of payment metadata may be more serious than direct asset losses. The email address, combined with a Bitcoin address, IBAN number and transaction history, could allow attackers to connect real-world individuals or businesses to bank information and activities visible on the Bitcoin public blockchain. Unlike stolen passwords, this historical connection cannot be easily erased. Merchants can change credentials, rotate API keys, or use new Bitcoin addresses, but previous on-chain transactions are always publicly visible. The same information may also make targeted phishing attacks more confusing. Attackers with real transaction details, addresses or bank information can use these records to increase credibility when making payments as Swiss Bitcoin or contacting affected merchants.

Password hashes are also among the potentially leaked information. Hash values are different from plaintext passwords, and their actual risks depend on multiple factors such as hashing method, password strength, and other security controls. Swiss Bitcoin payments have not disclosed these technical details.

Impact of server shutdown on merchants

This incident is also an operational crisis. Cutting off server connections may interrupt merchants that rely on Swiss Bitcoin payments in applications, dashboards, APIs or e-commerce integrations, making them unable to accept and process Bitcoin payments. This is important because companies use payment processors in part to avoid building and maintaining their own payment infrastructure. Even if customer assets remain secure, indefinite downtime can diminish one of the main advantages of outsourcing infrastructure.

Therefore, the next disclosure will be crucial to assessing the scale of the incident. Swiss Bitcoin Payments has not disclosed which systems were affected, whether customer records were downloaded, whether authentication tokens or API credentials were exposed, and how many users were affected. Customers also need to be extra vigilant when handling subsequent messages involving refunds, password resets, or account restoration. Detailed customer information may make it difficult to distinguish impersonation from legitimate customer service communications.

Swiss Bitcoin Payments, founded in 2022 and headquartered in Neuchâtel, now faces two tests: determining the full scope of unauthorized access, and restoring services to merchant infrastructure without adding additional security risks. The company's unmanaged architecture may have protected merchants 'Bitcoin assets, but the incident also shows that private keys are not the only valuable targets in encrypted payments. Databases that connect identities, bank accounts, and permanent on-chain activities themselves carry unique risks.