Swiss Bitcoin Pay shuts down servers after data breach exposes customer information

Swiss Bitcoin Pay shut down its servers on September 14, 2026, after detecting unauthorized access to its internal systems. The breach potentially exposed customer emails, Bitcoin addresses, IBANs, transaction histories, and hashed passwords. While the firm's non-custodial model keeps customer funds safe, the incident highlights a growing wave of data breaches hitting crypto firms like Trezor, SafePal, and Pocket Bitcoin in 2026, raising severe phishing and privacy risks.

Swiss Bitcoin Pay data breach

• ▪Swiss Bitcoin Pay shut down its entire server infrastructure on September 14, 2026, after detecting that an intruder had likely gained access to its internal systems.
• ▪Swiss Bitcoin Pay, which was founded in late 2022 and is based in Neuchâtel, Switzerland, has not provided a specific date for when its services will resume.
• ▪The Swiss Bitcoin Pay application is used by more than 1,000 merchants across 21 countries to accept Bitcoin payments.

Compromised customer information

• ▪Swiss Bitcoin Pay warned that the compromised data may include customer email addresses, Bitcoin addresses, bank IBANs, transaction histories, and hashed passwords.
• ▪Swiss Bitcoin Pay stated that it does not yet know how many customers are affected, how the attacker gained access, or whether the data was copied or merely viewed.

Non-custodial payment model

• ▪Swiss Bitcoin Pay explained that it briefly holds some user balances because it batches incoming Lightning payments to process them with a single on-chain output on a daily, weekly, or monthly cycle.
• ▪Swiss Bitcoin Pay operates as a non-custodial payment gateway that allows businesses to accept Bitcoin payments directly from customers using on-chain transactions and the Lightning Network.

User funds remain safe

• ▪Swiss Bitcoin Pay assured users that customer funds are safe and that any outstanding amounts owed to users will be fully returned.
• ▪Swiss Bitcoin Pay stated that no unauthorized Bitcoin movements have been identified following the September 14, 2026, server shutdown.

2026 crypto industry breaches

• ▪Swiss financial services provider Pocket Bitcoin disclosed a security incident that exposed the names, addresses, bank transfer amounts, and dates of 5,120 customers.
• ▪Hardware wallet maker Trezor confirmed on September 4, 2026, that a breach at its shipping provider, ShipMonk, exposed the names, emails, phone numbers, and shipping addresses of 67,000 US customers.
• ▪Fintech firm Revolut confirmed that it handed customer passports, driver's licenses, verification selfies, and transaction histories to an unauthorized party operating a fraudulent government-agency email domain.
• ▪Crypto wallet provider SafePal announced a data breach that exposed the order information, names, addresses, and purchase data of approximately 39,798 customers.

Phishing risks from exposure

• ▪The combination of customer email addresses, Bitcoin addresses, bank IBANs, transaction histories, and hashed passwords can be used by malicious actors to construct highly tailored phishing attacks.
• ▪The exposure of Bitcoin addresses allows third parties to link those addresses to real names, enabling anyone to trace an individual's on-chain transaction activity.