Security vulnerability at Bitonic allows unauthorized access to customer accounts
Bitonic fixed the security flaw after hackers raided 3 customer accounts.
Image by Cybernews.
Follow us
- Bitonic says attackers withdrew bitcoin from three accounts after exploiting a PDF-processing library vulnerability.
- The company reimbursed affected customers and says the vulnerability has been fixed.
- Bitonic is investigating whether attackers viewed other customers’ personal data.
- Customers should switch from email or SMS two-factor authentication to app-based one-time passwords.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
In the last few days, Dutch bitcoin company Bitonic has been dealing with a “security incident.” All damages have been compensated.
On Sunday evening, October 25th, IT employees discovered that “unauthorized parties” had gained access to some of Bitonic’s systems due to a security vulnerability.
As a precaution, the company took the affected systems and its hot wallet offline.
Despite this, the attackers succeeded in withdrawing bitcoin from 3 accounts. In addition, the login credentials of 2 accounts were changed.
Bitonic says that the vulnerability has been fixed and the affected systems have been fully restored. The affected account holders have been informed, and their stolen bitcoins have been reimbursed.
“At this time, we cannot rule out that the attacker also viewed the personal data of other customers. Based on what we currently know, this does not appear to be the case, but our investigation is still ongoing,” Bitonic says in a statement.
Cybersecurity experts are looking into the cause and scope of the incident. Bitonic says it’s taking additional measures to prevent this from happening again. The relevant authorities have been informed of the events.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
The bitcoin company is asking customers to change their 2-factor authentication (2FA) method from email/SMS to Time-based One-Time Password (TOTP). They’re also being asked to change the password of their Bitonic account if it’s weak or used elsewhere online.
Lastly, customers can set up a temporary block on bitcoin withdrawals, and should never share their recovery phrase or private keys.
According to Niels van Groningen, CEO and co-founder of Bitonic, the attackers exploited a vulnerability in the library used to process PDFs.
“We’ll be posting a detailed technical post-mortem soon, but we wanted to notify our customers first because we were offline last night while we were patching the vulnerability and ensuring that no further access was possible,” he promises.
Van Groningen adds that he’s grateful that only a small number of customers were affected and the amounts of bitcoin involved were small.
