Back Therecord.Media

Crypto e-commerce platform Bitrefill accuses North Korea of stealing 18,500 purchase records

Therecord.Media • March 18, 2026

Bitrefill said hackers allegedly tied to North Korea’s Lazarus group accessed around 18,500 purchase records that contained email addresses, crypto payment addresses, and metadata including IP addresses.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Bitrefill Cyberattack Linked to North Korea's Lazarus Group Exposes Customer Data Bitrefill, a crypto e-commerce platform, disclosed a cyberattack that began on March 1, 2026, attributed to North Korea's Lazarus Group. The breach started with a compromised employee laptop, allowing attackers to access sensitive infrastructure, including parts of the database and cryptocurrency wallets. Approximately 18,500 purchase records were affected, revealing email addresses, crypto payment addresses, and metadata like IP addresses. Out of these, around 1,000 records containing encrypted customer names were also potentially accessed. Bitrefill detected the breach through unusual supplier purchasing patterns and took all systems offline to contain the incident. The company is working with incident responders and law enforcement while restoring normal operations. They plan to absorb the financial losses through operational capital and are enhancing their security measures. 8 sources 76

Extracted Entities

Crypto e-commerce platform Bitrefill accuses North Korea of stealing 18,500 purchase records

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Companies (1)

Countries (1)