Security incident at Bitonic

On Sunday evening, 25 October, unauthorised parties gained access to part of our systems. A small amount of bitcoin was withdrawn from the accounts of three customers. These customers have been fully compensated. In this article, you can read what happened, what we have done, and what you can do yourself.

What happened?

On Sunday evening, we discovered that unauthorised parties had gained access to part of our systems through a vulnerability. As a precaution, we immediately took the affected systems, as well as our hot wallet, offline. Small unauthorised bitcoin withdrawals were made from three accounts. The login credentials of two accounts were changed.

The vulnerability was fixed immediately and the systems have been fully restored.

What data is involved?

The attacker was able to modify data in our systems, including the login credentials of several accounts. At this time, we cannot rule out that the attacker also viewed personal data of other customers. Based on what we currently know, this does not appear to be the case, but our investigation is still ongoing.

The access was limited to the system containing login credentials. Other systems and Bitonic's cold wallets were explicitly not involved in this incident.

What are we doing?

• We have personally informed the affected customers and fully reimbursed their bitcoin.
• We are continuing a thorough technical investigation into the cause and scope.
• We are taking additional measures to prevent this from happening again.
• We are informing the relevant regulators.

What can you do yourself?

• Change your two-factor authentication (2FA) method from email/SMS to TOTP (using an authenticator app) if you haven't done so already.
• If you have also used your Bitonic password elsewhere, or if you have used a weak password, consider changing your Bitonic password as a precaution in the app or on the website.

Other tips

• Set up a (temporary) block on bitcoin withdrawals: you can do this via the Bitonic app.
• Set up a personal anti-phishing phrase so you can easily recognise official emails from Bitonic.
• Be alert to messages that appear to come from Bitonic. Bitonic will never ask you to share your password or login codes, or to send your bitcoin to a different address.
• For anyone practising self-custody: never share your recovery phrase (seed phrase) or private keys.
• Do you see something in your account that you don't recognise? Contact us immediately through our official channels or email us at contact@bitonic.nl.

Current status

Our services are fully available again.

We are sorry that this happened. You entrust us with your bitcoin and your data, and we take that responsibility very seriously. We are fully confident that we can once again serve our customers safely. We will update this article as soon as there are new developments.