Snip
Importantly, your Bitcoin is safe. Unlike other payment processors, Swiss Bitcoin Pay is a non-custodial service. Meaning they dont hold onto users Bitcoin. Payments are sent to merchants Bitcoin addresses directly. Therefore, there is no way for the hacker to drain your Bitcoin, despite having full access to their server.
This is unlike previous crypto-related hacks like the $320M Liquid Network hack and the theft of 267K XRP where the respective platforms did hold onto their users assets.
But this hack is still bad. Its important to be on your toes in case someone uses their newfound knowledge about your IBAN, Bitcoin addresses, transactions, and other financial dealings to verify themselves as Swiss Bitcoin Pay via DM and steal your credentials, convince you to reset your password, or steal a 2FA code. Similar tactics were seen during the Trezor hack and Solana Mobile hack earlier this year.
Swiss Bitcoin Pay is considered a financial intermediary under Swiss anti-money laundering (AML) law. As such, the company is required to notify users and the Swiss data protection regulator (FDPIC) if a data leak meets certain requirements. Its not clear if either has happened.
As for what to do? Make sure to change your Swiss Bitcoin Pay password everywhere else you may have used it and ignore anyone who messages you claiming to be Swiss Bitcoin Pay employees.
