Bitrefill Discloses Data Breach Linked to Suspected North Korean Hackers

ChainCatcher report: Bitcoin payment service Bitrefill disclosed on X that it suffered a cyberattack on March 1, 2026, resulting in a customer data breach. The attack originated from a compromised employee laptop, allowing attackers to access certain databases and cryptocurrency wallets. Investigation findings indicate that the attack methodology closely resembles past campaigns by the North Korean DPRK Lazarus/Bluenoroff hacking group targeting crypto firms. Approximately 18,500 purchase records contained limited customer information—including email addresses, cryptocurrency payment addresses, and IP metadata—while around 1,000 records included encrypted customer names that may have been accessed. Bitrefill stated that customers do not need to take any specific action but are advised to remain vigilant for suspicious communications. The company added that the affected systems have been shut down and isolated, and it is collaborating with security experts, on-chain analysts, and law enforcement; operations are now nearly fully restored. Bitrefill emphasized that it remains financially sound and profitable, capable of absorbing this loss, and will continue strengthening its cybersecurity measures, including internal access controls, monitoring, and incident response protocols.