Bitonic fixes PDF library flaw after bitcoin account breach

Dutch bitcoin company Bitonic says unauthorized parties accessed some systems through a security flaw and withdrew bitcoin from three customer accounts. The company took affected systems and its hot wallet offline, fixed the vulnerability, restored systems, reimbursed affected customers, and is still investigating whether other customers' personal data was viewed.

What happened

On Sunday evening, October 25, IT employees discovered that unauthorized parties had gained access to some Bitonic systems due to a security vulnerability. As a precaution, the company took the affected systems and its hot wallet offline. Despite this, attackers withdrew bitcoin from three accounts and changed the login credentials of two accounts. Affected account holders were informed, and their stolen bitcoins were reimbursed.

Vulnerability and response

According to Niels van Groningen, CEO and co-founder of Bitonic, attackers exploited a vulnerability in the library used to process PDFs. Bitonic says the vulnerability has been fixed and affected systems have been fully restored. Cybersecurity experts are looking into the cause and scope of the incident, additional measures are being taken, and relevant authorities have been informed. A detailed technical post-mortem will be posted soon.

Customer guidance

Bitonic asks customers to change two-factor authentication from email or SMS to Time-based One-Time Password. Customers should also change their Bitonic account password if it is weak or used elsewhere online. They can set a temporary block on bitcoin withdrawals and should never share their recovery phrase or private keys. Bitonic says it cannot rule out that the attacker viewed personal data of other customers, but based on current knowledge this does not appear to be the case, and the investigation is ongoing. Van Groningen says he is grateful that only a small number of customers were affected and the amounts of bitcoin involved were small.

Sources: Cybernews