Security incident at Bitonic (update)

On Sunday evening, 25 October, unauthorised parties gained access to part of our systems. A small amount of bitcoin was withdrawn from the accounts of three customers. These customers have been fully compensated. In this article, you can read what happened, what we have done, and what you can do yourself.

What happened?

On Sunday evening, we discovered that unauthorised parties had gained access to part of our systems through a vulnerability. As a precaution, we immediately took the affected systems, as well as our hot wallet, offline. Small unauthorised bitcoin withdrawals were made from three accounts. The login credentials of two accounts were changed.

The vulnerability was fixed immediately and the systems have been fully restored.

What data is involved?

The attacker was able to modify data in our systems, including the login credentials of several accounts. At this time, we cannot rule out that the attacker also viewed personal data of other customers. Based on what we currently know, this does not appear to be the case, but our investigation is still ongoing.

The access was limited to the system containing login credentials. Other systems and Bitonic's cold wallets were explicitly not involved in this incident.

What are we doing?

• We have personally informed the affected customers and fully reimbursed their bitcoin.
• We are continuing a thorough technical investigation into the cause and scope.
• We are taking additional measures to prevent this from happening again.
• We are informing the relevant regulators.

What can you do yourself?

• Change your two-factor authentication (2FA) method from email/SMS to TOTP (using an authenticator app) if you haven't done so already.
• If you have also used your Bitonic password elsewhere, or if you have used a weak password, consider changing your Bitonic password as a precaution in the app or on the website.

Other tips

• Set up a (temporary) block on bitcoin withdrawals: you can do this via the Bitonic app.
• Set up a personal anti-phishing phrase so you can easily recognise official emails from Bitonic.
• Be alert to messages that appear to come from Bitonic. Bitonic will never ask you to share your password or login codes, or to send your bitcoin to a different address.
• For anyone practising self-custody: never share your recovery phrase (seed phrase) or private keys.
• Do you see something in your account that you don't recognise? Contact us immediately through our official channels or email us at contact@bitonic.nl.

Current status

Our services are fully available again.

We are sorry that this happened. You entrust us with your bitcoin and your data, and we take that responsibility very seriously. We are fully confident that we can once again serve our customers safely.

Update: 28 October

We can now share more information about the incident.

On Sunday evening, 25 October, a customer reported suspicious activity on their account. We immediately started an investigation and, as a precaution, took all of our services offline. That same night, we identified the cause: a vulnerability in the PDF upload function of our verification system, in the library we use to process PDF files. We secured the attacker's traces for further investigation, fixed the vulnerability and cleaned up our systems. Our services were available again at 05:00 on Monday morning.

Through this vulnerability, the attacker took over five accounts. Bitcoin was withdrawn from three of them, totalling 0.003 BTC, worth around €200. We fully reimbursed these customers that same night. We have personally informed all five customers. We have reviewed all withdrawals and account changes from that period and found no other affected accounts.

We store customers' personal documents, such as identity documents, encrypted in a separate system. The attacker did not have access to it. Apart from the five accounts that were taken over, we have no indication that customers' personal data was stolen. While our investigation is ongoing, we cannot yet fully rule this out. As previously reported, Bitonic's cold wallets, which hold the vast majority of the bitcoin, were not involved in the incident.

You don't need to do anything at this time. We are closely monitoring our systems and are temporarily applying stricter checks to bitcoin withdrawals. If you would like to secure your account further, please follow the tips above. We particularly recommend these two: set up a withdrawal block, which lets you set a waiting period for bitcoin withdrawals yourself in the app, and enable two-factor authentication (2FA), preferably using an (offline) authenticator app. Also remain alert to messages that appear to come from Bitonic.

We have informed the Dutch Authority for the Financial Markets (AFM) and the Dutch Data Protection Authority (AP). We are also in contact with the police and will be filing a report.

We will update this article as soon as there are new developments.