Bitrefill accuses North Korea-linked Lazarus hacker group for compromising 18,500 purchase records

Cryptocurrency payments and gift card platform Bitrefill has identified the North Korea-linked hacking group Lazarus as responsible for a cyberattack on March 1, 2026. The attack compromised parts of its infrastructure and cryptocurrency wallets, leading to the transfer of funds from hot wallets and the exposure of approximately 18,500 purchase records. Bitrefill has announced it will cover all losses incurred from operational capital and has resumed operations.

Attack Details and Modus Operandi

The breach began with a compromised employee laptop, which provided attackers with legacy credentials, granting them access to Bitrefill's infrastructure, database, and cryptocurrency wallets. Unusual purchasing patterns and draining of hot wallets were observed, prompting the company to take its systems offline to contain the damage. Bitrefill noted the attackers' methods, including malware, on-chain tracing, and the reuse of IP and email addresses, were consistent with previous attacks attributed to the Lazarus Group, also known as Bluenoroff.

Customer Data Exposure

The cyberattack resulted in the exposure of about 18,500 purchase records. These records contained information such as email addresses, crypto payment addresses, and IP addresses. Approximately 1,000 records also included encrypted usernames. Bitrefill stated there is no evidence that customer data was the primary target, as logs indicated attackers focused on cryptocurrency holdings and gift card inventory rather than extracting the entire database. Affected users have been notified via email, and while no additional action is currently deemed necessary, customers are advised to exercise caution regarding unexpected communications.

Security Enhancements and Future Outlook

In response to the incident, Bitrefill has implemented strengthened cybersecurity measures. These include conducting comprehensive penetration tests with external experts, tightening internal access controls, enhancing logging and monitoring for faster threat detection, and refining incident response procedures and automated shutdown protocols. Despite this being its first major attack in over a decade, Bitrefill affirmed it remains well-funded and profitable, capable of absorbing operational losses. Most systems have been restored, with sales volumes returning to normal.