Swiss Bitcoin Pay, the Neuchâtel-based Bitcoin payment processor, temporarily pulled the plug on its servers following a suspected data breach.
No customer funds or private keys were reported at risk.
What we know so far
Swiss Bitcoin Pay Sàrl operates as a licensed Financial Intermediary in Switzerland, providing merchants with tools to accept Bitcoin payments through both on-chain transactions and the Lightning Network. The company charges 1% on payments retained in Bitcoin and 1.5% when merchants opt for automatic conversion to fiat currency.
No official statement has been released detailing the scope of the suspected breach, the type of data potentially exposed, or the number of users who might be affected.
The company’s core architecture is non-custodial, meaning payments flow directly to merchants’ personal wallets rather than sitting in Swiss Bitcoin Pay’s accounts.
The company’s app, which is open-source and available on both iOS and Android, remains accessible alongside its merchant API. Minor security updates have reportedly been pushed through in the wake of the incident.
A pattern in the Swiss crypto ecosystem
In August 2026, Pocket Bitcoin, a separate but related service in the Swiss crypto ecosystem, experienced a data exposure that affected 5,411 customers. That incident was distinct from the Swiss Bitcoin Pay situation. In the Pocket Bitcoin case, no customer funds were reported at risk either.
Swiss Bitcoin Pay was established in late 2022, positioning itself as a sovereignty-oriented payment solution for businesses ranging from restaurants to retail outlets. The company supports multiple payment methods including Bolt Cards, which use NFC technology for tap-to-pay Bitcoin transactions.
What this means for merchants and the non-custodial model
Non-custodial solutions reduce the risk of catastrophic fund loss. If a non-custodial processor gets breached, attackers can’t drain customer wallets because those wallets were never in the processor’s possession.
But non-custodial does not mean non-vulnerable. Server infrastructure still holds merchant account data, transaction logs, API keys, and potentially identifying information.
The company’s decision to shut down servers rather than attempt to patch while running suggests they took the threat seriously enough to accept downtime. As of mid-September 2026, Swiss Bitcoin Pay has not issued detailed public information regarding affected parties or data types.