Quick Read
- Bitrefill experienced a cyberattack on March 1, 2026, leading to financial losses and data exposure.
- A compromised employee laptop allowed attackers to access company infrastructure and cryptocurrency wallets.
- North Korea’s Lazarus Group is suspected of being behind the sophisticated cyberattack.
NEW YORK (Azat TV) – Crypto gift card issuer Bitrefill announced Tuesday that it was the victim of a cyberattack on March 1, 2026, which resulted in the draining of company funds and the exposure of a subset of user data. The company’s internal investigation suggests that North Korea-linked Lazarus Group may be responsible for the breach.
Compromised Credentials Led to Breach
According to an incident report released by Bitrefill, the attack originated from a compromised employee laptop. Hackers were able to exfiltrate a legacy credential, which they then used to access parts of Bitrefill’s infrastructure, including its database and cryptocurrency wallets. The method of attack bears similarities to previous cyber operations attributed to North Korea’s Lazarus and Bluenoroff groups, which have targeted other entities within the cryptocurrency industry.
Financial Losses and Data Exposure
Bitrefill’s initial detection of the breach came through suspicious purchasing patterns observed with certain suppliers, leading to the discovery that gift card stocks and supply lines were being exploited. Simultaneously, the company found that its hot wallets had been drained of funds. While Bitrefill stated that customer data was not the primary target and there is no evidence of the entire customer database being compromised, the attackers did access and query a select number of purchase records. This resulted in the exposure of approximately 18,500 purchase records, which contained customer email addresses, crypto payment addresses, and metadata, including IP addresses. A smaller subset of about 1,000 records also included customer names in encrypted formats, which were potentially exposed. Bitrefill has directly notified impacted customers via email.
Lazarus Group Suspected
The company’s analysis of the attack vectors and operational similarities has led it to identify North Korea’s Lazarus Group as a potential perpetrator. This group has been a persistent threat in the cybersecurity landscape, known for its involvement in sophisticated cyber heists and cryptocurrency theft to fund the regime.
The incident underscores the ongoing threat posed by state-sponsored hacking groups to the digital economy, particularly within the volatile cryptocurrency sector, highlighting the need for robust security measures and continuous vigilance.