Bitrefill
- Date (as written)
- 2026-03
- Year
- 2026
- Country
- Sweden
- Actors (as written)
- Bluenoroff
- Actor pages
- Bluenoroff
- Tags (as written)
- Cryptocurrency FinancialGain DataBreach
- Dollar figures (as written)
- $2,500,000; -
Source entries (4)
Bitrefill · 2026-03
Bitrefill experienced a cyberattack beginning around early March 2026, which was traced back to a compromised employee device that exposed internal credentials. Using this access, attackers infiltrated the company’s systems and were able to drain funds from its hot wallets while also abusing its gift card infrastructure. The breach led to unauthorized transactions and unusual purchasing activity, which eventually triggered detection and forced the company to shut down parts of its system to contain the incident. In addition to financial losses, the attackers accessed tens of thousands of purchase records, including customer emails, crypto wallet addresses, and some encrypted data. Bitrefill has not disclosed the exact amount stolen but confirmed both monetary damage and operational disruption. The company noted that the attack showed patterns similar to those used by the Lazarus Group, although it stopped short of making a definitive attribution.
Bitrefill · 2026-03-01
Amt Stolen: $2,500,000
Bitrefill · 2026-03-01
Description of the event: Bitcoin payment service provider Bitrefill disclosed on X that it suffered a cyberattack on March 1, 2026, resulting in a customer data breach. The attack originated from a compromised employee laptop, which allowed the attacker to access parts of the company’s databases and cryptocurrency wallets.The investigation indicates that the attack methods closely resemble those previously used by the North Korean DPRK Lazarus Group / Bluenoroff hacking organization in targeting crypto companies.Approximately 18,500 purchase records were affected, involving limited customer information such as email addresses, crypto payment addresses, and IP metadata. Among these, around 1,000 records contained customer names stored in encrypted form, which may also have been accessed.Bitrefill stated that customers do not need to take specific action but are advised to remain vigilant for any suspicious communications.The company added that the affected systems have been shut down and isolated, and it is working with security experts, on-chain analysts, and law enforcement agencies. Operations have now largely returned to normal.Bitrefill emphasized that it remains financially strong and profitable, capable of absorbing the losses from this incident, and will continue strengthening its cybersecurity measures, including internal access controls, monitoring, and incident response mechanisms. | Amount of loss: - | Reference: https://www.theblock.co/post/393974/crypto-ecommerce-bitrefill-discloses-cyberattack-north-koreas-lazarus-potential-suspect
Bitrefill · 17/03/2026
Bitrefill attributes a recent infrastructure breach to North Korea’s Lazarus Group. After compromising an employee’s laptop, attackers drained hot wallets, exploited gift card inventory, and stole 18,500 purchase records. The company identified the state-sponsored group through malware analysis, on-chain tracing, and reused IP addresses. [Date Occurred: 01/03/2026; Date Discovered: 01/03/2026]
Suggest a correction on GitHub