Switzerland-based payment provider Swiss Bitcoin Pay has temporarily shut down its servers after detecting suspected unauthorized access to its internal systems, disrupting Bitcoin and Lightning Network payment services while the company investigates the incident and strengthens its infrastructure. The disclosure was made on September 14.
Potentially accessible information includes customer email addresses, Bitcoin addresses, IBANs, transaction histories, and password hashes. The company has not disclosed how attackers may have gained access, how many customers may be affected, or whether any data was actually copied. No timetable for restoring servers has been given. It said customer funds remain safe and amounts owed will be returned in full. There is currently no evidence that merchant private keys were compromised or that Bitcoin was removed from customers’ self-custody wallets.
Why the non-custodial model matters: Swiss Bitcoin Pay differs from custodial exchanges because merchant Bitcoin is designed to reach wallets controlled by merchants, not remain under company control. The platform supports Bitcoin and Lightning Network payments via mobile app, dashboard, e-commerce integrations, and API. Businesses can keep payments in Bitcoin or auto-convert to fiat through banking. This limits direct theft risk but does not eliminate exposure: incoming Lightning payments can remain temporarily within company systems before being consolidated into on-chain Bitcoin outputs on daily, weekly or monthly schedules. Those amounts are generally limited, the company said.
The potential exposure of payment metadata may be significant. Email addresses combined with Bitcoin addresses, IBANs, and transaction histories could allow attackers to connect real-world identities and banking information to public blockchain activity. Unlike passwords, historical blockchain links cannot be erased. The data could also enable convincing phishing using genuine transaction details. Password hashes were potentially exposed, but risk depends on hashing method and password strength, which have not been disclosed.
The shutdown creates an operational problem for merchants relying on Swiss Bitcoin Pay to accept and process payments, weakening a key benefit of outsourcing payment infrastructure. The next disclosure will be important to determine which systems were reached, whether records were downloaded, whether authentication tokens or API credentials were exposed, and how many users were affected. Customers should be cautious with follow-up messages about refunds, password resets, or account recovery.
Founded in Switzerland in 2022 and based in Neuchâtel, Swiss Bitcoin Pay now faces two tests: establishing the full scope of unauthorized access and restoring infrastructure without creating additional security risk. The incident shows that private keys are not the only valuable target in crypto payments; databases linking identities, bank accounts, and permanent blockchain activity carry their own risks.
