In an attack detected on October 25, 2026, an intruder took over five Bitonic customer accounts and withdrew bitcoin from three of them. Bitonic said it fully reimbursed affected customers, fixed the vulnerability, and is continuing its investigation.
What happened in the Bitonic attack?
Bitonic said an intruder accessed part of its systems on the evening of October 25 and took over five customer accounts.
Bitcoin was withdrawn from three accounts. An ANP report published on October 28 put the loss at approximately €200; the exact amount in BTC was not publicly specified. Bitonic said it fully reimbursed the affected customers.
Early reports described unauthorized access and changes to account login details. A later update said five accounts were taken over, while withdrawals occurred from three.
How did the attacker gain access?
In an interview with BNR, Bitonic’s CEO linked the intrusion to a vulnerability in the PDF-upload feature used for verification, while the investigation remains ongoing.
The CEO said the vulnerability involved processing PDF files uploaded through the verification feature. This is the company’s explanation as reported in an interview, not a final published technical postmortem.
After discovering the issue, Bitonic took affected systems offline as a precaution, then fixed the vulnerability and restored services. The available reports do not provide a full technical account or final investigation results.
Was customer personal data confirmed stolen?
There is no final confirmation that other customers’ personal data was accessed or stolen; Bitonic said it could not rule out that possibility while its investigation continued.
As of October 28, the company said it had no indication that personal data beyond the affected accounts had been taken, but noted that its review was ongoing. The available information therefore supports neither a claim of a confirmed wider data leak nor a definitive claim that no access occurred.
Media reports say Bitonic preserved digital evidence and planned to provide it to police. The company also reported contacting relevant supervisory authorities.
What account-security steps should customers consider?
Customers should follow Bitonic’s official notices, use app-based authentication, and never share login codes or send funds in response to suspicious requests.
Reports about the incident advised customers to review their account security and watch for messages impersonating Bitonic. Practical steps include:
- Use two-factor authentication through an authenticator app, if available.
- Change a weak or reused password.
- Consider temporarily blocking bitcoin withdrawals if that option is available in the account.
- Never share a password or 2FA code, or send bitcoin to an address at the request of a message or caller.
- Check notices through the official app or by opening the company’s website directly, rather than following links in suspicious messages.
These steps do not replace Bitonic’s official instructions. Customers with concerns should contact the company through verified channels.
FAQ
How many Bitonic accounts were affected?
An update on October 28 said five accounts were taken over. Bitcoin was withdrawn from three of them.
Did Bitonic return the stolen funds?
Yes. The company said it fully reimbursed the affected customers.
Was a personal-data breach confirmed?
No. As of October 28, Bitonic had not reported a confirmed breach of data beyond the affected accounts, but it said access could not be ruled out while the investigation continued.
What caused the breach?
Bitonic’s CEO linked the intrusion to a vulnerability in the PDF-upload feature used for verification. The available reports did not include a final technical postmortem.