Bitrefill says March breach drained funds and exposed 18,500 purchase records; blames North Korea-linked group

Bitrefill disclosed that it was the target of a cyberattack on March 1, 2026, which accessed roughly 18,500 purchase records and resulted in company funds being drained ^[1].

According to the company’s incident report, the attackers began by compromising an employee laptop and used an old credential to gain access to production systems, allowing them to escalate privileges and access wallets and other infrastructure ^{[2] [3]}.

Bitrefill said the indicators point to a North Korea‑linked group (commonly associated with Lazarus/Bluenoroff) as the likely perpetrator, and the company has confirmed limited customer data exposure while investigations and remediation continue ^{[2] [4] [3]}.

Bitrefill has published a detailed incident report and attributed the intrusion to a likely state‑linked actor; investigations and remediation efforts are ongoing as the company notifies affected parties ^{[1] [2]}.