# Bitonic reimburses three customers after bitcoin theft Author: Hatice Ertaş Language: English Published: 2026-10-27T13:53:07+03:00 Updated: 2026-10-27T18:27:51+03:00 ![Orange access card with a Bitcoin symbol, graphite reader and closed metal security panel; conceptual image.](https://kriptometa.com/uploads/bitonic-te-bitcoin-hirsizligi-uc-musteriye-geri-odeme-df871002c757_article.webp) ## Key takeaways - Bitonic says bitcoin taken from three customer accounts has been reimbursed in full. - Login credentials were changed for two accounts; possible access to other personal data remains under investigation. - Services are restored. The company recommends authenticator apps and account security measures. Bitonic says it reimbursed unauthorized bitcoin withdrawals from three accounts. Services are back, while possible access to personal data remains under investigation. Dutch [crypto trading platform](https://kriptometa.com/en/best-crypto-exchanges) Bitonic says attackers accessed part of its systems on Sunday evening, October 25, and withdrew bitcoin from three customers’ accounts. According to its [October 26 disclosure](https://bitonic.nl/en/news/308/security-incident-at-bitonic), the customers have been fully reimbursed. Login credentials were also changed for two accounts. Services have resumed, while Bitonic continues to investigate whether other customers’ personal data was viewed. ## Three accounts lost bitcoin; two had login details changed Bitonic says an attacker exploited a vulnerability to access the system holding login credentials. The attacker could also change account data. The company described the unauthorized withdrawals as small but did not disclose a total in bitcoin or fiat currency. It did not say whether the two accounts with changed credentials overlap with the three that lost funds. The number of distinct customers across the two groups remains unknown. Bitonic took the affected systems and its internet-connected [hot wallet](https://kriptometa.com/en/choose-crypto-wallet) offline as a precaution after detecting the incident. It says the vulnerability was fixed immediately and the systems fully restored. [NOS, which obtained an email to customers](https://nos.nl/artikel/2636798-nederlandse-bitcoinbroker-bitonic-gehackt-kleine-bedragen-van-klanten-gestolen), reported that everyone was logged out of the website and app as a precaution. Bitonic reported unauthorized withdrawals from only three accounts. What Bitonic disclosed on October 26, and what remains unclear. | Issue | Disclosed position | |---|---| | Unauthorized bitcoin withdrawals | Three accounts; the company says losses were fully reimbursed. No total was disclosed. | | Changed login credentials | Two accounts; overlap with the withdrawal cases was not specified. | | Other customers’ personal data | Access cannot be ruled out, although the company’s current findings do not suggest it occurred. | | Cold wallets and other systems | Outside the scope of the incident, according to the company. | ## Bitcoin reimbursed as the data investigation continues Bitonic says it contacted the affected customers individually and repaid their bitcoin losses in full. The company did not say whether any funds were recovered from the attacker or how it financed the payments. Bitonic is still investigating how the attacker gained access and what was affected. It also says it is taking further measures to prevent a repeat and informing the relevant regulators. > “fully reimbursed their bitcoin” Bitonic’s description of its payment to affected customers in the October 26 disclosure. Bitonic says it has not found evidence that other customers’ personal data was viewed. Its investigation is continuing, however, and it cannot rule out that possibility. It has not named the accessible data fields, the way passwords were stored, the vulnerability or the attacker. There has been no confirmed announcement that every password was stolen. Bitonic says its cold wallets were unaffected. In its general [custody explanation](https://bitonic.nl/nl/security), the company describes holding bitcoin offline and requiring multiple signatures to send it. Protecting offline keys and allowing a customer to log in online require different controls. The company says the incident was limited to the login system; no independent incident audit has been published. ## Services restored, but withdrawals may face extra checks The [official status page](https://bitonic.statuspage.io/) marked the outage opened at 23:35 CET on October 25 as resolved at 05:14 CET on October 26, equivalent to 22:35 and 04:14 UTC. On October 27, it lists deposits and withdrawals, the website and the app as operational. The attacker’s initial access time has not been disclosed; the outage record does not establish it. Bitonic’s X post at 04:16 UTC on October 26 said systems were back to normal. NOS reported that the company would continue monitoring bitcoin withdrawals more closely, which could make them take longer than usual. No end date for the additional checks or delay for an individual withdrawal was given. [Bitonic’s October 26 post announcing that its systems were back to normal.](https://x.com/Bitonic/status/2114571806971703354) ## What is Bitonic asking customers to do? Bitonic recommends replacing email or SMS login codes with an authenticator app. The app generates time-based one-time passwords, known as TOTP codes. Email is the default method, according to its [two-factor authentication guide](https://bitonic.nl/nl/faq/87/wat-is-tweestapsverificatie-en-waarom-is-het-belangrijk). With an app, customers enter a code that changes at regular intervals alongside their password. No link between SMS and the attack has been disclosed. App-based authentication does not guarantee protection against every attack. Bitonic asks customers who reused their password elsewhere or chose a weak one to consider changing it as a precaution. They can do so in the app or on the website. Customers can also temporarily block bitcoin withdrawals through the app. The company has not imposed a mandatory password reset or a deadline on everyone. Customers can also set a [personal anti-phishing phrase](https://kriptometa.com/en/glossary/phishing) to help recognize official emails. According to [Bitonic’s instructions](https://bitonic.nl/nl/faq/141/wat-is-een-anti-phishingzin-en-hoe-stel-ik-deze-in), the word or phrase is configured in the app’s security tab or the website’s account section and appears at the top of its emails. [Checking the sender and link destination](https://kriptometa.com/en/crypto-phishing-fake-token-checks), and opening the site through a bookmark or by typing its address, are also among the company’s [security recommendations](https://bitonic.nl/nl/safety). **Watch for fake support messages:** Bitonic says it will not ask for passwords or login codes, or tell customers to send bitcoin elsewhere because of a security incident. [People using their own wallets](https://kriptometa.com/en/glossary/custodial-non-custodial-wallet) should never share [recovery phrases](https://kriptometa.com/en/glossary/seed-phrase) or [private keys](https://kriptometa.com/en/glossary/private-key). For unfamiliar account activity, use the company’s official channels or contact@bitonic.nl, the address in its disclosure.