Bitonic to report hack to police and confirms €200 loss

Dutch Bitcoin broker Bitonic has released new information about the hack of 25 October. During the security incident, hackers gained access to five customer accounts, three of which had Bitcoin stolen. In total, the amount involved was just 0.003 BTC, worth around €200. In an update dated 28 October, Bitonic explains how the attackers got in and what measures the company has now taken.

The attack came to light on the evening of Sunday 25 October, when a customer reported suspicious activity on their account. Bitonic then took its services offline as a precaution. The affected customers had their stolen Bitcoin returned in full the same night, and service was available again by 5am on Monday.

Vulnerability in PDF feature made hack possible

The investigation shows that the attackers gained access through a vulnerability in the feature customers use to upload PDF files for identity verification.

According to Bitonic, the problem lay in a software library used to process these documents. This allowed unauthorised parties to gain access to part of its systems.

The company identified the cause that same night, secured the digital evidence and fixed the vulnerability. The affected systems were subsequently cleaned.

The attacker managed to take over five accounts. In three of them, Bitcoin withdrawals were made without the owners’ consent.

Bitonic then reviewed all withdrawals and account changes from the relevant period. No other affected accounts were identified.

Personal data and cold wallets remain unaffected

A key question after the hack is whether the attackers also gained access to customers’ personal documents.

According to Bitonic, identity documents and other sensitive documents remain secure. This data is stored in encrypted form in a separate system to which the attacker has no access.

Beyond the five accounts taken over, there are also no indications that personal data has been stolen. However, the company cannot yet rule this out entirely while the investigation is ongoing.

In addition, Bitonic’s cold wallets were not affected by the incident. The company stores the majority of its Bitcoin reserves in them.

Bitonic has now reported the security incident to the Netherlands Authority for the Financial Markets (AFM) and the Dutch Data Protection Authority (AP). It is also in contact with the police and is preparing to file a criminal complaint.

Bitonic temporarily tightens security

According to Bitonic, customers do not currently need to take any action themselves. However, the company is temporarily applying stricter checks to Bitcoin withdrawals and keeping its systems under additional scrutiny.

Users who want to secure their account better are advised to set up a withdrawal lock. This allows them to add a waiting period in the app before Bitcoin can be withdrawn.

Bitonic also advises using two-factor authentication, preferably via an authenticator app.

The company also warns customers to remain alert to phishing messages that appear to come from Bitonic.

The new update makes clear that the financial damage is limited to around €200. The investigation into the full extent of the incident is continuing.