Crypto platform Bitrefill suffers breach as Lazarus Group suspected

Traders Union
All News
Crypto
Crypto platform bitrefill

Highlights

Bitrefill suffers cyberattack exposing 18,500 customer purchase records
Lazarus Group suspected based on attack patterns and malware
Hackers accessed wallets and gift cards via compromised employee device

A Lazarus-style attack

According to The Block, Swedish platform Bitrefill, which operates in 186 countries, became the victim of a cyberattack in which hackers gained access to 18,500 customer purchase records and drained parts of the company’s hot wallets and customer gift cards.

The incident began on March 1, when attackers gained access through a compromised employee laptop. This was followed by breaches of certain Bitrefill crypto wallets and suspicious purchases from the company’s suppliers.

While Bitrefill has not disclosed the total financial damage, it acknowledged that hackers accessed “a broader portion of Bitrefill’s infrastructure, including parts of its database.” Around 1,000 out of 18,500 customer records face an elevated risk of exposure of encrypted customer names. The company said it has contacted the affected individuals.

In a post on X on Tuesday, Bitrefill stated that based on observed indicators during the investigation — including attack methods, malware used, blockchain tracing, and reuse of IP addresses and emails — the attack was most likely carried out by North Korea’s Lazarus Group and its hacking subgroup Bluenoroff.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

However, Bitrefill noted that it has no reason to believe the attackers were specifically targeting its database. Instead, only a limited number of queries were executed to gain access to cryptocurrency funds and gift card balances.

The company said it initially shut down systems as part of its containment strategy, but operations have now been largely restored. Bitrefill also stated it will cover the losses using its operational capital. During the response, it worked with cybersecurity firms zeroShadow, SEAL911, RecoverisTeam, and others.

Key risks for crypto security

According to Chainalysis, North Korea-linked groups and individuals stole over $2 billion in cryptocurrency in 2025 out of a total $3.4 billion stolen, making the country the most active and significant threat in the crypto space today.

The possible involvement of Lazarus heightens concerns among institutional market participants, as such attacks are not only financial but also geopolitical in nature. For the industry, this implies rising security costs, stricter compliance requirements, and further consolidation around players capable of investing in advanced protection and incident response systems.

Additionally, the incident highlights systemic vulnerabilities in crypto companies operating hybrid infrastructures that combine user data, hot wallets, and third-party integrations. Even with strong blockchain-layer security, attacks via compromised employee devices remain one of the most effective vectors, once again underscoring the human factor as a critical cybersecurity risk.

As we wrote, Lazarus hackers use Zoom to steal crypto wallet funds

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.