Dutch Bitcoin exchange Bitonic has been hacked, but the company reassures customers

The Dutch Bitcoin exchange Bitonic was hit by a hack last night, the company announced this evening. Through a leak in a piece of software, attackers took Bitcoins away from a handful of customers.

The damage is (fortunately) limited. The company quickly came with a reassuring message and even those affected do not have to lie awake.

In a message on his website, Bitonic lists what happened. On Sunday evening, 25 October, unauthorised persons were granted access to some of the systems, after which three customers were able to carry out "small Bitcoin withdrawals" without permission.

The attackers came in via a vulnerability in a library for processing PDFs. Such a library is a ready-made piece of software that developers build into their own systems.

For two accounts, they also changed the login details. The company does not disclose exactly how much bitcoin is involved, but the three affected customers have already been fully reimbursed.

The company does not disclose exactly how many Bitcoins are involved. The affected customers were personally informed, and later a comprehensive technical analysis of what went wrong follows.

As a precaution, Bitonic went off the air last night to seal the leak, and all customers were logged out. In the meantime, everything is working again, although recordings may take longer for the time being due to additional checks.

Bitonic, like many crypto exchanges, divides its Bitcoin into two places. A small part is online in a so-called hot wallet, so that withdrawals run fast. The rest is offline, where hackers cannot access it. The attackers did not arrive at that offline part.

This places a ceiling on the damage, explains founder and director Niels van Groningen. “In the extreme case, we have to reimburse the amount from the hot wallet. In this way, we keep the risk manageable."

One question is still open. “At the moment, we cannot rule out that the attacker has also accessed other customers' personal data,” Bitonic said. The company does not think so, but is still investigating it.

Those who want to take the safe for granted can change their password. Therefore, let the extra login code come from an app on your phone instead of via SMS or email. In addition, Bitonic never asks customers for their password or to send Bitcoin to another address.

In addition, according to the company, customers should convert their two-step verification (2FA), an additional code in addition to the password, from SMS or email to an authenticator app. Those who use their password elsewhere are better off changing it.

Bitonic is the oldest Bitcoin company in the Netherlands. Van Groningen started in March 2012 with Jouke Hofman and Robert de Waard under the name iDealCoin. A few months later, that became Bitonic, an anagram of Bitcoin.

The company was the first in the Netherlands to automatically sell Bitcoin via iDEAL, at a time when it could still be very complicated to purchase the coin. Other coins never came in, because Bitonic doesn't want to know anything about what it calls “complicated hypecoins”.

Since then, the broker has seen several major crashes and exchanges like Mt. Gox and FTX go down. In 2021, Bitonic even went to court against De Nederlandsche Bank (DNB), which subsequently dropped its controversial requirement for wallet verification.

Since November 2025, Bitonic has been licensed under MiCA, the European crypto law, by the Netherlands Authority for the Financial Markets (AFM). The company is now also informing the relevant regulators about the hack.

Although the incident now also underlines that the business is in good order, trust will be the greatest damage.