Verify a decision

{"actor":"system:backfill","investigation_id":"2079e4be-4a5d-42c0-88d0-91c277a9f231","kind":"publish","page_slug":"swiss-bitcoin-pay","published_at":"2026-09-16T12:14:55.601Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Swiss Bitcoin Pay","sections":[{"content":"Swiss Bitcoin Pay Sàrl is registered in Neuchâtel, Switzerland, and operates as a licensed financial intermediary subject to Swiss anti-money laundering (AML) regulation. The company was founded in late 2022 and is led by Jimmy Larbi Djabali. It provides Bitcoin payment acceptance infrastructure for merchants, supporting both on-chain transactions and Lightning Network payments. The company's website claims more than 1,000 active merchant integrations across 21 countries. Its fee structure is 1% on Bitcoin-retained payments and 1.5% for automatic fiat conversion. The platform offers open-source mobile applications for iOS and Android, a merchant API, and support for Bolt Cards with NFC tap-to-pay functionality.","heading":"Company Overview","severity":"low","sources":[{"credibility":2,"name":"KuCoin News: Swiss Bitcoin Pay Shuts Down Servers After Suspected Data Breach","type":"news_article","url":"https://www.kucoin.com/news/flash/swiss-bitcoin-pay-shuts-down-servers-after-suspected-data-breach"},{"credibility":2,"name":"Crypto Briefing: Swiss Bitcoin Pay shuts down servers after suspected breach","type":"news_article","url":"https://cryptobriefing.com/swiss-bitcoin-pay-suspected-breach/"}]},{"content":"On September 14, 2026, Swiss Bitcoin Pay announced via X (formerly Twitter) that it was temporarily shutting down its servers after detecting likely unauthorized access to its internal systems. The company's public statement read: \"A malicious user has likely gained access to Swiss Bitcoin Pay's internal systems. As a precaution, we are temporarily shutting down our servers while we investigate and secure our infrastructure.\" The company confirmed five categories of data as potentially exposed: customer email addresses, Bitcoin wallet addresses, IBAN bank account numbers, transaction histories, and hashed passwords. As of September 16, 2026, the company had not disclosed the number of affected accounts, the attack vector, whether data was exfiltrated or only viewed, or a timeline for service restoration. The investigation was described as ongoing.","heading":"September 2026 Security Incident","severity":"high","sources":[{"credibility":2,"name":"The Daily Hodl: Swiss Bitcoin Payment Platform Takes Servers Offline After Suspected Internal Breach","type":"news_article","url":"https://dailyhodl.com/2026/09/15/swiss-bitcoin-payment-platform-takes-servers-offline-after-suspected-internal-breach/"},{"credibility":2,"name":"CryptoTimes: Swiss Bitcoin Pay Shuts Down Servers After Suspected Hack","type":"news_article","url":"https://www.cryptotimes.io/2026/09/14/swiss-bitcoin-pay-shuts-down-servers-after-suspected-hack/"},{"credibility":2,"name":"Bitcoin Magazine: Swiss Bitcoin Pay Data Breach","type":"news_article","url":"https://bitcoinmagazine.com/news/swiss-bitcoin-pay-data-breach"},{"credibility":2,"name":"Crypto Briefing: Swiss Bitcoin Pay shuts down servers after suspected breach","type":"news_article","url":"https://cryptobriefing.com/swiss-bitcoin-pay-suspected-breach/"}]},{"content":"The five categories of data reportedly exposed in the incident are particularly sensitive in combination. Email addresses paired with Bitcoin wallet addresses and IBAN bank account numbers enable targeted phishing campaigns that can convincingly impersonate the platform or financial institutions. Transaction histories allow an attacker to reference specific payment amounts and dates, substantially increasing the credibility of social-engineering attempts. Hashed passwords pose a credential-stuffing risk if the hashing algorithm used was weak or if password reuse is common among affected users. Security analyst Pasquale Pillitteri, cited in reporting by Cryptopolitan, characterized the combined data set as \"textbook material for a tailored phishing attack.\" The exposure of Bitcoin addresses linked to real-world identities also reduces pseudonymity for affected users, as on-chain transaction history becomes attributable to known individuals.","heading":"Data Exposure and Downstream Risk","severity":"high","sources":[{"credibility":2,"name":"Cryptopolitan: Swiss Bitcoin Pay shuts down servers as hacker gains access to customer info","type":"news_article","url":"https://www.cryptopolitan.com/swiss-bitcoin-pay-hacker-access/"},{"credibility":2,"name":"CryptoTimes: Swiss Bitcoin Pay Shuts Down Servers After Suspected Hack","type":"news_article","url":"https://www.cryptotimes.io/2026/09/14/swiss-bitcoin-pay-shuts-down-servers-after-suspected-hack/"}]},{"content":"Swiss Bitcoin Pay asserted in its public disclosure that user funds and private keys were not compromised. The platform's non-custodial architecture routes payments directly to merchant wallets rather than pooling funds in company-controlled accounts, which limits the financial impact of a server-side breach. The company stated: \"User funds are safe, and any amounts owed to users will be fully returned.\" However, reporting by Blockzeit noted that the company's disclosures revealed a nuance in its non-custodial model: when batching Lightning Network transactions for daily, weekly, or monthly settlement to on-chain UTXOs, the platform temporarily holds small user balances. This characteristic has drawn commentary from some observers who argue it blurs the boundary between custodial and non-custodial operation during settlement windows. As of September 16, 2026, no funds had been reported as stolen or missing, and no independent on-chain analysis confirming or contradicting the company's claims had been published.","heading":"Fund Safety and Non-Custodial Architecture","severity":"medium","sources":[{"credibility":2,"name":"Blockzeit: Swiss Bitcoin Pay Temporarily Shuts Down, Critics Scrutinize Its Non-Custodial Claim","type":"news_article","url":"https://blockzeit.com/swiss-bitcoin-pay-shuts-down-critics-scrutinize-non-custodial-claim/"},{"credibility":2,"name":"KuCoin News: Swiss Bitcoin Pay Shuts Down Servers After Suspected Data Breach","type":"news_article","url":"https://www.kucoin.com/news/flash/swiss-bitcoin-pay-shuts-down-servers-after-suspected-data-breach"},{"credibility":2,"name":"CryptoTimes: Swiss Bitcoin Pay Shuts Down Servers After Suspected Hack","type":"news_article","url":"https://www.cryptotimes.io/2026/09/14/swiss-bitcoin-pay-shuts-down-servers-after-suspected-hack/"}]},{"content":"Swiss Bitcoin Pay Sàrl is registered in Neuchâtel, Switzerland, and operates as a licensed financial intermediary under Switzerland's Anti-Money Laundering Act (AMLA). Payment token businesses that qualify as financial intermediaries under AMLA but do not require a full FINMA banking or payment institution licence are required to affiliate with a FINMA-recognized self-regulatory organization (SRO) for AML supervision. The specific SRO with which Swiss Bitcoin Pay is affiliated has not been confirmed in publicly available reporting reviewed for this investigation. No regulatory enforcement actions, fines, or sanctions by FINMA or any other authority against Swiss Bitcoin Pay have been identified in available sources as of the publication date.","heading":"Regulatory Status","severity":"low","sources":[{"credibility":2,"name":"KuCoin News: Swiss Bitcoin Pay Shuts Down Servers After Suspected Data Breach","type":"news_article","url":"https://www.kucoin.com/news/flash/swiss-bitcoin-pay-shuts-down-servers-after-suspected-data-breach"}]},{"content":"As of September 16, 2026, several material questions about the incident remain unanswered in public disclosures. The company has not stated: the total number of merchants or end-users whose data may have been exposed; the attack vector or method of unauthorized access; whether data was exfiltrated from company servers or only accessed; the identity or affiliation of the alleged unauthorized party; the hashing algorithm used for stored passwords; or a target date for service restoration. The absence of these details limits the ability of affected merchants and users to assess their individual risk. No law enforcement notifications or mandatory Swiss data protection authority (FDPIC) breach notifications have been reported in available sources.","heading":"Disclosure Gaps and Unresolved Questions","severity":"medium","sources":[{"credibility":2,"name":"The Daily Hodl: Swiss Bitcoin Payment Platform Takes Servers Offline After Suspected Internal Breach","type":"news_article","url":"https://dailyhodl.com/2026/09/15/swiss-bitcoin-payment-platform-takes-servers-offline-after-suspected-internal-breach/"},{"credibility":2,"name":"Bitcoin.com News: Swiss Bitcoin Pay Just Went Dark After a Mysterious Intruder","type":"news_article","url":"https://news.bitcoin.com/security/swiss-bitcoin-pay-just-went-dark-after-a-mysterious-intruder/"}]}],"sources_used":[{"credibility":2,"name":"The Daily Hodl: Swiss Bitcoin Payment Platform Takes Servers Offline After Suspected Internal Breach","type":"news_article","url":"https://dailyhodl.com/2026/09/15/swiss-bitcoin-payment-platform-takes-servers-offline-after-suspected-internal-breach/"},{"credibility":2,"name":"KuCoin News: Swiss Bitcoin Pay Shuts Down Servers After Suspected Data Breach","type":"news_article","url":"https://www.kucoin.com/news/flash/swiss-bitcoin-pay-shuts-down-servers-after-suspected-data-breach"},{"credibility":2,"name":"Bitcoin.com News: Swiss Bitcoin Pay Just Went Dark After a Mysterious Intruder","type":"news_article","url":"https://news.bitcoin.com/security/swiss-bitcoin-pay-just-went-dark-after-a-mysterious-intruder/"},{"credibility":2,"name":"CryptoTimes: Swiss Bitcoin Pay Shuts Down Servers After Suspected Hack","type":"news_article","url":"https://www.cryptotimes.io/2026/09/14/swiss-bitcoin-pay-shuts-down-servers-after-suspected-hack/"},{"credibility":2,"name":"Bitcoin Magazine: Swiss Bitcoin Pay Data Breach","type":"news_article","url":"https://bitcoinmagazine.com/news/swiss-bitcoin-pay-data-breach"},{"credibility":2,"name":"Crypto Briefing: Swiss Bitcoin Pay shuts down servers after suspected breach","type":"news_article","url":"https://cryptobriefing.com/swiss-bitcoin-pay-suspected-breach/"},{"credibility":2,"name":"Cryptopolitan: Swiss Bitcoin Pay shuts down servers as hacker gains access to customer info","type":"news_article","url":"https://www.cryptopolitan.com/swiss-bitcoin-pay-hacker-access/"},{"credibility":2,"name":"Blockzeit: Swiss Bitcoin Pay Temporarily Shuts Down, Critics Scrutinize Its Non-Custodial Claim","type":"news_article","url":"https://blockzeit.com/swiss-bitcoin-pay-shuts-down-critics-scrutinize-non-custodial-claim/"}],"summary":"Swiss Bitcoin Pay is a non-custodial Bitcoin payment processor incorporated as Swiss Bitcoin Pay Sàrl in Neuchâtel, Switzerland, serving over 1,000 merchants in 21 countries since late 2022. On September 14, 2026, the company took its servers offline after detecting suspected unauthorized access to its internal systems. No customer funds or private keys were reported as compromised, but five categories of sensitive personal and financial data were confirmed as potentially exposed, creating material phishing and social-engineering risk for affected merchants and customers.","timeline":[{"date":"2022-12-01","event":"Swiss Bitcoin Pay Sàrl founded in Neuchâtel, Switzerland, and begins operating as a non-custodial Bitcoin payment processor for merchants.","source":"KuCoin News","source_url":"https://www.kucoin.com/news/flash/swiss-bitcoin-pay-shuts-down-servers-after-suspected-data-breach"},{"date":"2026-09-14","event":"Swiss Bitcoin Pay detects likely unauthorized access to its internal systems and takes its servers offline as a precautionary measure, posting a public statement on X.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/09/14/swiss-bitcoin-pay-shuts-down-servers-after-suspected-hack/"},{"date":"2026-09-14","event":"Company confirms five categories of potentially exposed data: customer email addresses, Bitcoin wallet addresses, IBAN numbers, transaction histories, and hashed passwords. States user funds are safe and pledges to return all amounts owed.","source":"Bitcoin Magazine","source_url":"https://bitcoinmagazine.com/news/swiss-bitcoin-pay-data-breach"},{"date":"2026-09-15","event":"Major crypto news outlets including The Daily Hodl, Bitcoin.com News, and Crypto Briefing publish coverage of the incident. Critics begin scrutinizing the platform's non-custodial claims.","source":"The Daily Hodl","source_url":"https://dailyhodl.com/2026/09/15/swiss-bitcoin-payment-platform-takes-servers-offline-after-suspected-internal-breach/"},{"date":"2026-09-16","event":"Servers remain offline. No reopening date announced. Number of affected users, attack vector, and extent of data exfiltration remain undisclosed.","source":"Bitcoin.com News","source_url":"https://news.bitcoin.com/security/swiss-bitcoin-pay-just-went-dark-after-a-mysterious-intruder/"}]},"v":1}