Bitonic, a service for buying and selling bitcoin registered with the Dutch Chamber of Commerce, said in a notice published on 26 October 2026 that on the evening of Sunday 25 October unauthorised parties gained access to part of its systems through a vulnerability, and that a small amount of bitcoin was withdrawn from the accounts of three customers, who have been fully compensated.

Bitonic says it immediately took the affected systems and its hot wallet offline as a precaution, that the login credentials of two accounts were changed, and that the vulnerability was fixed straight away and its systems fully restored.

According to Bitonic, the attacker was able to modify data in its systems, including the login credentials of several accounts, and the access was limited to the system holding login credentials; its other systems and cold wallets were not involved.

Bitonic says it cannot yet rule out that the attacker also viewed other customers' personal data, although based on what it currently knows this does not appear to be the case, and that its investigation into the cause and scope is continuing.

It says it has personally informed and reimbursed the affected customers and is informing the relevant regulators. Bitonic has not named the vulnerability.