Bitrefill disclosed that it suffered a data breach in early March due to a suspected North Korean hacking attack.

Bitcoin payment service provider Bitrefill disclosed on the X platform that it suffered a cyberattack on March 1, 2026, resulting in a data breach of its customers. The attack originated from an employee's compromised laptop, leading to access to some databases and cryptocurrency wallets by the attackers. Investigations revealed that the attack method was highly similar to past attacks against crypto companies by the North Korean hacking group DPRK Lazarus/Bluenoroff. Approximately 18,500 purchase records involved limited customer information (email, encrypted payment addresses, and IP metadata), of which about 1,000 records contained encrypted customer names, but these could potentially be accessed. Bitrefill stated that customers do not need to take any special action, but are advised to be vigilant for unusual information. Bitrefill added that the affected systems have been isolated and they are cooperating with security experts, on-chain analysts, and law enforcement. Operations have almost returned to normal. The company emphasized that it has long-term profitability and sufficient funds to absorb the losses and will continue to strengthen its cybersecurity measures, including internal access control, monitoring, and incident response mechanisms.