Lazarus Group Suspected in Bitrefill Cyberattack

On March 1, 2026, Bitrefill, a cryptocurrency online retailer, fell victim to a cyberattack attributed to the North Korean hacking group Lazarus Group, a division of BlueNoroff. The attack was publicly reported by Bitrefill on March 17, where they noted significant similarities to previous incidents involving the same group.

March 1st incident report

On March 1, 2026, Bitrefill was the target of a cyberattack. Based on indicators observed during the investigation — including the modus operandi, the malware used, on-chain tracing and reused IP + email addresses (!) — we find many similarities…

— Bitrefill (@bitrefill) March 17, 2026

The breach initiated from a compromised employee laptop, from which hackers accessed old credentials and subsequently elevated their privileges to infiltrate critical infrastructure, including databases and cryptocurrency wallets. The security team detected unusual activities related to gift cards and fund transfers, prompting an immediate shutdown of all systems.

Data Compromise

Investigations revealed that the attackers gained access to around 18,500 purchase records, which included sensitive information such as email addresses, cryptocurrency addresses, and metadata like IP addresses. In approximately 1,000 instances, customer names linked to specific purchases were also exposed, although such data was encrypted. Bitrefill has classified this information as compromised and has informed the affected customers.

Notably, verification data remained secure, as it is managed by an external provider without backups in Bitrefill’s systems. The company has committed to covering any financial losses from its operational funds and has since restored full service functionality.

Law enforcement and cybersecurity firms, including Security Alliance and zeroShadow, are collaborating on the investigation. In response to the incident, Bitrefill has enhanced its security protocols, added monitoring tools, and revised its incident response strategies. Interestingly, this attack comes at a time when hacking-related losses in the cryptocurrency sector had recently reached a low not seen in 11 months.