Bitrefill Suffers Security Breach Linked to Lazarus Group Hackers

The cryptocurrency gift card and payment platform Bitrefill has officially disclosed a security breach that occurred on March 1, 2026. According to the company, the incident resulted in the unauthorized access of sensitive customer data and the theft of assets from a hot wallet. Preliminary investigations suggest that the breach was orchestrated by the Lazarus Group (also known as Bluenoroff), a sophisticated cyber-espionage collective frequently associated with high-profile attacks on the blockchain industry.

Mechanism of the Cyberattack

The intrusion originated from the compromise of an individual employee's device, which led to the leakage of critical administrative credentials. These stolen credentials allowed the attackers to infiltrate specific segments of Bitrefill’s database and gain control over a hot wallet used for processing transactions. While the exact financial valuation of the stolen assets has not been publicly specified, the company confirmed that the attackers successfully transferred funds out of its immediate control.

Impact on User Data and Operations

The breach extended beyond financial assets, impacting approximately 18,500 order records. The exposed information includes:

• Email addresses associated with customer accounts.
• Cryptocurrency addresses used for transactions.
• Partial names for a subset of the affected users.

It is important to note that Bitrefill does not store comprehensive Know Your Customer (KYC) documentation, which may have limited the extent of the identity theft risk for its global user base. The company has emphasized that its core business operations have largely recovered from the disruption and that security protocols have been reinforced to prevent a recurrence of the credential leak.

Corporate Response and Mitigation

In a statement regarding the financial impact, Bitrefill assured its users that all losses resulting from the attack will be borne by the company itself, ensuring that individual customer balances remain unaffected. This move follows a standard industry practice among established platforms to maintain user trust following security lapses.

The safety of our users' funds is our highest priority. We have taken immediate steps to isolate the compromised systems and are working with cybersecurity experts to further harden our infrastructure against state-sponsored threats.

As the investigation continues, users are advised to remain vigilant against potential phishing attempts that may utilize the leaked email addresses and transaction history. The incident serves as a reminder of the persistent threat posed by advanced persistent threat (APT) groups to the decentralized finance (DeFi) and retail crypto payment sectors.