Bitrefill attack drains company crypto wallets and exposes about 18,500 purchase records
Attackers stole Bitrefill’s crypto and gift-card inventory and accessed about 18,500 purchase records. Bitrefill said customer balances were unaffected. Customers should be cautious of unexpected Bitrefill or crypto messages; no software update is required.
Bitrefill said customers did not need to take specific action beyond being cautious of unexpected Bitrefill or cryptocurrency messages. Open the official website or app directly to verify communications, and avoid unfamiliar links.
What’s happening
Bitrefill, which sells gift cards and phone credit for cryptocurrency, suffered an attack on 1 March 2026. A compromised employee laptop exposed an old credential, allowing attackers to reach internal systems, company cryptocurrency wallets and purchase records. Approximately 18,500 records contained email addresses, cryptocurrency payment addresses and IP addresses. Encrypted names associated with about 1,000 purchases were also treated as potentially exposed; those customers were emailed. Bitrefill said customer balances were unaffected and it would cover its losses, without publishing an amount. It identified similarities to North Korea’s Lazarus/Bluenoroff attacks, rather than presenting independently confirmed attribution. By 17 March, most operations were restored and security improvements were continuing. No customer software patch applies. The public updates found through 3 November do not establish whether stolen funds were recovered, charges were laid or a final investigation report was issued.
- What
- Breach
- Affects
- Bitrefill gift-card and phone top-up service
- Fixed in
- Nothing to patch
- Since
- 1 Mar 2026
- Closed
- 17 Mar 2026
Timeline
- Update
Bitrefill said most operations had returned to normal and it would absorb the losses from its own operating capital. It was working with security specialists and law enforcement and strengthening access controls, monitoring and incident response.
- Made public
Bitrefill disclosed access to approximately 18,500 purchase records. Encrypted names associated with about 1,000 purchases were potentially exposed because attackers might have obtained encryption keys; customers in that group had been emailed.
- Update
Bitrefill’s service-status update listed accounts, previous purchases, store credits and products as available. Its accompanying guidance said full functionality and inventory were still being restored.
- UpdateNothing to patch
Attackers drained some Bitrefill cryptocurrency wallets and abused gift-card stock and supplier purchasing lines. Bitrefill detected suspicious purchases and took its systems offline.
Sources
- March 1st incident report — full Bitrefill statement reproduced on Stacker NewsBitrefill (reproduced on Stacker News) · 17 Mar 2026
- Service Status PageBitrefill · 10 Mar 2026
- Crypto Gift Card Platform Bitrefill Discloses Hack, Points Finger at North Korean GroupsDecrypt · 17 Mar 2026
- Bitrefill blames North Korean Lazarus group for cyberattackBleepingComputer · 19 Mar 2026