Odaily Planet Daily reports that Bitcoin payment service Bitrefill disclosed on X that it suffered a cyberattack on March 1, 2026, resulting in a customer data breach. The attack originated from a compromised employee laptop, allowing attackers to access certain databases and cryptocurrency wallets. Investigations indicate that the attack methodology closely resembles past campaigns by the North Korean DPRK Lazarus/Bluenoroff hacking group targeting crypto companies. Approximately 18,500 purchase records containing limited customer information—such as email addresses, cryptocurrency payment addresses, and IP metadata—were exposed; around 1,000 of these records included encrypted customer names that may have been accessed. Bitrefill stated that customers do not need to take specific actions but are advised to remain vigilant for suspicious communications.
Bitrefill stated that the affected systems have been isolated, and it is collaborating with security experts, on-chain analysts, and law enforcement. Operations are now nearly back to normal. The company emphasized that it remains financially sound and profitable in the long term, with sufficient funds to absorb this loss, and will continue strengthening its cybersecurity measures, including internal access controls, monitoring, and incident response protocols.