Crypto Gift Card Platform Bitrefill Blames North Korean Hackers for Systems Breach and Fund Losses

Lazarus Group Targets Bitrefill in Sophisticated Cyber Heist

A single compromised laptop served as the gateway for one of the most notorious hacking collectives to infiltrate Bitrefill, a prominent crypto-to-gift-card platform.

The company recently confirmed that it fell victim to an intrusion on 1 March 2026, pointing the finger at the North Korean-linked Lazarus Group, also known as Bluenoroff.

This is the same entity behind the staggering $1 billion theft from Bybit early last year.

The attackers did not just stumble into the system; they meticulously exploited a legacy credential found within a system snapshot to escalate their access, eventually reaching the heart of the company’s production secrets and several cryptocurrency hot wallets.

How Did the Intruders Slip Through the Net

The breach began quietly when an employee's device was infected with malware.

Once the hackers secured their initial foothold, they moved laterally through Bitrefill's infrastructure.

The company’s security team only realized something was wrong when they spotted "suspicious purchasing patterns" involving their gift card suppliers.

While the attackers were busy exploiting inventory and supply lines, they were simultaneously draining hot wallets.

In a decisive move to stop the bleeding, Bitrefill pulled the plug on its entire global network.

Because the e-commerce giant manages thousands of products and dozens of suppliers, the cleanup and rebooting process was a massive undertaking that kept services offline for over two weeks.

What Was Stolen During the Breach

While Bitrefill has not disclosed the exact dollar value of the digital assets lost, it confirmed that the financial hit would be absorbed by the company’s own operational capital.

The firm was quick to reassure its user base that all individual account balances remain safe and unaffected.

Interestingly, the hackers seemed less interested in a mass data haul and more focused on immediate liquid assets.

According to the company's logs, “based on our investigation and logs, we don’t have reason to think that customer data was the objective.”

Instead, the intruders performed limited queries, appearing to hunt for high-value targets like crypto holdings and gift card stock.

Is Your Personal Information at Risk

Despite the focus on funds, the breach did expose some customer information.

Approximately 18,500 purchase records were accessed, which included email addresses, crypto payment addresses, and IP metadata.

A smaller group of about 1,000 customers who provided names for specific products saw their data potentially compromised.

Although these names were encrypted, Bitrefill warned that the hackers might have obtained the encryption keys.

The company has already reached out to those affected.

Fortunately, Bitrefill’s lean data policy acted as a natural defense.

They do not require mandatory KYC for most users, and any sensitive identity documents are stored with a third-party provider, keeping them out of reach of the internal servers that were hit.

Why Is the Lazarus Group the Main Suspect

The evidence pointing to North Korea is substantial.

Bitrefill worked alongside security heavyweights like Zeroshadow and SEAL Org to trace the stolen funds on the blockchain and conduct forensic analysis.

The investigation uncovered malware signatures, reused IP addresses, and email accounts previously tied to DPRK operations.

This attack follows a grim trend in the industry, where North Korean hackers were reportedly responsible for over $2 billion in crypto thefts in 2025 alone.

To prevent a repeat performance, Bitrefill has overhauled its internal access controls and automated its incident response, ensuring that a single compromised device can no longer jeopardize the entire network.