Bitrefill Discloses Cyberattack on Hot Wallets

Bitrefill, a cryptocurrency-based ecommerce platform for purchasing gift cards, disclosed a sophisticated cyberattack on March 1, 2026, that resulted in the drainage of funds from its hot wallets and the access of approximately 18,500 customer purchase records. The incident, which originated from a compromised employee laptop, bears multiple similarities to tactics employed by the North Korean-linked Lazarus Group, according to the company's investigation.

The breach began when attackers gained access to an employee's device and extracted a legacy credential tied to production systems. This initial foothold allowed them to retrieve sensitive production secrets and escalate privileges across Bitrefill's infrastructure, reaching segments of its internal database and specific cryptocurrency wallets. From there, the intruders drained an undisclosed amount of funds from the hot wallets and transferred them to addresses under their control. Simultaneously, they exploited the platform's gift card inventory system to conduct suspicious purchases through supplier networks, disrupting operations.

Bitrefill detected the intrusion through irregular purchasing patterns and anomalies in...