Bitrefill Discloses Suspected North Korean Hacker Attack on March 1, With Approximately 18,500 Customer Purchase Records Leaked

Gate News: On March 17, Bitcoin payment service provider Bitrefill disclosed on the X platform that on March 1, they suffered a cyberattack resulting in a data breach. The attack originated from an employee’s compromised laptop, which allowed attackers to access some databases and cryptocurrency wallets. Investigations show that the attack method closely resembles previous assaults by North Korea’s DPRK Lazarus/Bluenoroff hacking group targeting crypto companies. About 18,500 purchase records involved limited customer information, including email addresses, encrypted payment addresses, and IP metadata. Approximately 1,000 records contained customer names encrypted but potentially accessible. Bitrefill stated that customers do not need to take special actions but should remain vigilant for unusual activity. The company has isolated affected systems and is working with security experts, on-chain analysts, and law enforcement. Operations have largely returned to normal. Bitrefill emphasized that the business remains profitable and well-funded, capable of absorbing the loss, and will continue to strengthen cybersecurity measures, including internal access controls, monitoring, and incident response mechanisms.