Overview
- Swiss Bitcoin Pay temporarily took its servers offline on Monday while investigating likely unauthorized access to its internal systems.
- The company says user funds were not held by the processor and will be returned if owed, so wallets and private keys were not directly compromised.
- Swiss Bitcoin Pay reported that attackers may have accessed customer email addresses, bitcoin addresses, IBANs transaction history and hashed passwords.
- The firm’s noncustodial design routes payments straight to merchants’ wallets which prevents direct theft of funds but leaves server logs and account metadata vulnerable.
- The incident follows several 2026 data exposures at crypto and fintech firms and raises near-term phishing and privacy risks for customers and merchants.