Crypto payments platform Bitrefill has disclosed details of a sophisticated cyberattack that targeted its infrastructure earlier this month, with indicators pointing to links with North Korea’s notorious Lazarus Group.
According to a statement shared on March 17, the breach occurred on March 1, 2026, after attackers gained initial access through a compromised employee’s laptop
March 1st incident reportOn March 1, 2026, Bitrefill was the target of a cyberattack. Based on indicators observed during the investigation – including the modus operandi, the malware used, on-chain tracing and reused IP + email addresses (!) – we find many similarities…
— Bitrefill (@bitrefill) March 17, 2026
A legacy credential was reportedly exfiltrated, allowing unauthorized access to a snapshot containing production secrets. This enabled the attackers to escalate privileges and infiltrate broader systems, including parts of the company’s database and certain cryptocurrency wallets.
The incident was first detected when Bitrefill noticed unusual purchasing patterns involving suppliers, alongside the draining of funds from some hot wallets. The attackers also exploited gift card inventory and supply lines
In response, the company immediately took its systems offline to contain the breach, temporarily disrupting its global operations.
Bitrefill confirmed that around 18,500 purchase records were accessed during the incident. The exposed data includes limited customer information such as email addresses, crypto wallet addresses, and metadata like IP addresses
Additionally, approximately 1,000 transactions involving products that required customer names may have been compromised, although this data was encrypted. The company has already notified affected users directly.
Despite the breach, Bitrefill stated there is no evidence that its full database was extracted or that customer data was the primary target. The company emphasized that it stores minimal personal data and relies on external providers for Know Your Customer (KYC) verification.
Following the attack, Bitrefill has been working with cybersecurity experts, on-chain analysts, and law enforcement agencies to investigate the incident and strengthen its defenses
The firm has since enhanced access controls, improved monitoring systems, and conducted extensive security reviews.
While the attack resulted in financial losses, Bitrefill said it remains profitable and will absorb the impact using operational capital. Most services have now been restored, with transaction volumes returning to normal levels.
Your web3 identity + services + payments in one single link. Get your pay3.so link today.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Arbitrum Security Council Freezes 30,766 ETH From KelpDAO Exploit, 9 of 12 Members Vote in Favor
Arbitrum froze 30,766 ETH from the KelpDAO hack, worked with law enforcement, and recovered about a quarter of assets, while locking funds pending governance amid decentralization versus security debates.
Abstract: This article reports that the Arbitrum Security Council froze 30,766 ETH (about $70 million) tied to the KelpDAO exploit, with nine of twelve votes, and moved funds to a secure wallet in coordination with law enforcement. The operation targeted only affected assets to minimize network disruption. The exploiter is suspected to be DPRK-associated. The breach began April 18 via a LayerZero-powered bridge, draining 116,500 rsETH (~$292 million). About a quarter of stolen assets have been recovered. The frozen funds will remain locked until governance and legal authorities decide the next steps, prompting debate over decentralization versus security.
GateNews58m ago
Korean National Tax Service Launches Crypto Tax-Evasion Crackdown in July: Even Self-Custody Wallets and Mixing Services Can Be Traced
According to a report by ZDNet Korea, South Korea’s National Tax Service (NTS) issued on April 15 a procurement notice for a “virtual asset tax evasion response and transaction tracking software,” with plans to complete system selection by the end of May, deploy it in June, and officially launch it in July. The new system will be able to track self-custodied (non-custodial) wallets such as MetaMask and Phantom, and will include “demixing” technology to enforce tax evasion against offenders who use mixers to conceal the flow of funds.
This is the third upgrade to South Korea’s crypto tax investigation tracking system since 2024. In conjunction with new tax legislation that, starting in 2026, will formally bring crypto assets under taxation under the “Other Income” category of the comprehensive income tax, enforcement tools are being upgraded at the same time to improve collection efficiency.
Procurement scope: Chainalysis and TRM
ChainNewsAbmedia1h ago
South Korea's Tax Authority Introduces Crypto Tracking Software to Monitor Tax Evasion, Including Non-Custodial Wallets
Gate News message, April 21 — South Korea's National Tax Service announced on April 15 that it plans to deploy crypto asset tracking software from firms including Chainalysis and TRM Labs to monitor cryptocurrency transactions in real time, trace hidden assets of suspected tax evaders, and combat mo
GateNews2h ago
Arbitrum emergency freezes KelpDAO hacker’s 30,766 ETH
Arbitrum’s Security Committee announced on April 21 that it has taken emergency action to freeze 30,766 ETH on the Arbitrum One chain related to the KelpDAO hacker attack. With assistance from law enforcement agencies, the Security Committee confirmed the attacker’s identity and devised a technical plan to transfer the funds to an interim freeze wallet without affecting any other chain state or Arbitrum users.
MarketWhisper4h ago
DefiLlama denies exaggerated claims about the metrics, saying that Aave data has been excluded from the circulating liquidity calculation
KelpDAO’s vulnerability caused Aave’s total value locked (TVL) to fall from $26.4 billion on April 18, 2026, to about $17 billion on April 21, and after DefiLlama founder 0xngmi officially responded on the X platform to accusations that its Aave TVL figures were inflated by circular liquidity, he said that the amount of borrowed tokens has been deducted from the TVL.
MarketWhisper6h ago
Chinese National Arrested at Buenos Aires Airport for $49.4M Crypto Fraud Scheme
A Chinese national was arrested in Argentina for carrying a forged Paraguayan passport. He is wanted for orchestrating a $49.4 million cryptocurrency fraud in Nigeria, and extradition proceedings are being initiated.
GateNews8h ago
