Swiss Bitcoin Pay has announced a temporary suspension of its operations following a significant security breach. The payment processor, which marketed itself as non-custodial, revealed that the attack compromised sensitive user data, though the full scope of the incident remains under investigation. This development has prompted users to question the platform’s non-custodial claims, casting doubt on its marketing assertions.
The Security Breach
In a statement posted on X, Swiss Bitcoin Pay disclosed that an unauthorized actor gained access to its internal systems. The company suspects that the breach exposed critical customer information, including personal email addresses, Bitcoin wallet addresses, IBANs, transaction histories, and hashed passwords.
While the investigation is ongoing and the full extent of the compromised data remains unclear, the platform has assured users that their funds are secure. Furthermore, the company has committed to reimbursing customers for any assets lost during the attack.
Swiss Bitcoin Pay has not yet established a timeline for reopening, as it continues to identify and patch all system vulnerabilities. The team stated it is working diligently to secure the platform, aiming to restore services more robustly than before.
Scrutiny Over Non-Custodial Claims
Amid the controversy, observers have questioned why Swiss Bitcoin Pay felt compelled to guarantee the safety of user funds and promise compensation for losses. Such assurances seem contradictory for a platform that has prominently marketed itself as non-custodial.
In the cryptocurrency sector, a non-custodial model grants users total and exclusive control over their digital assets and private keys, meaning intermediaries should have no access to the funds. Consequently, Swiss Bitcoin Pay’s pledge to reimburse customers for lost assets raises significant questions regarding its non-custodial status.
In response, Swiss Bitcoin Pay clarified that it automatically consolidates incoming Lightning transactions into a single on-chain UTXO (Unspent Transaction Output) on a daily, weekly, and monthly basis. This process necessitates the temporary holding of some user funds, though the company maintains that these retained amounts are not significant.
Critics, however, remain unconvinced by the platform’s justification for holding user funds. Regardless of the amount or duration involved, the primary concern is that marketing the service as “non-custodial” is fundamentally misleading to consumers.
