π’Swiss Bitcoin Pay is back online.
First, the essentials: no funds were lost. That includes merchant balances awaiting onchain settlement, which are fully intact, and cards balances. All amounts owed didn't moved.
As stated on Monday, we continue to assume that customer email addresses, Bitcoin addresses, IBANs, transaction history and hashed passwords may have been accessed. We are treating that data as compromised.
We can now add one finding: we found no evidence that identity or KYC/KYB documents (that some of our customers had chosen to provide) were extracted. Every attempt we traced to copy files out to the attacker's server failed. We want to be precise: no evidence is not the same as a guarantee. This is what our deep investigation found, and we will tell you if that ever changes.
We have closed the vulnerability, rotated every credential, and drastically hardened our infrastructure.
One thing we want to be open about: we had been working for months on a new infrastructure and modern stack, built to a far higher security standard. It was scheduled to go live this week. A few days earlier, and this attack would not have been possible. We are not saying this as an excuse: the system that was breached was ours, and so is the responsibility. We are saying it because you deserve the full picture, not a curated one.
What we recommend: change your password, and change it anywhere you reused it (or use a password manager). Be sceptical of any message about this incident, even one that already knows your details: with an email, an IBAN and a transaction history, phishing gets convincing. We will never contact you asking for a password, a seed phrase, or to move funds.
Thank you for your patience this week. We took the time to do this properly.
We're back, and stronger.