{"investigation":{"slug":"bitrefill","entity_name":"Bitrefill","trust_score":79,"severity_base":79,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Bitrefill is a Stockholm-registered e-commerce platform, founded by Sergej Kotliar and co-founders in 2014 or 2015, that lets users buy gift cards and mobile phone top-ups with cryptocurrency. In March 2026 the company disclosed a cyberattack that exposed roughly 18,500 purchase records and drained some hot wallets, which it tentatively attributed to North Korea's Lazarus/BlueNoroff group; no regulatory action or lawsuit tied to the incident has been found. Trustpilot shows mostly positive reviews alongside a recurring minority of complaints about already-redeemed gift card codes and slow support.","sections":[{"content":"Bitrefill disclosed on March 17, 2026 that it had been the target of a cyberattack that began on March 1, 2026. According to Bitrefill's own incident report, as quoted by Decrypt, 'On March 1, 2026, Bitrefill was the target of a cyberattack,' which the company said began with a compromised employee laptop. Bitrefill stated that approximately 18,500 purchase records were affected, exposing fields such as email addresses, cryptocurrency payment addresses, and IP-address metadata. For roughly 1,000 of those purchases, encrypted customer names were also potentially exposed because attackers may have obtained decryption keys; Bitrefill said it contacted those individuals directly. Reporting from The Block and Decrypt indicates attackers drained funds from some hot wallets and made suspicious purchases through vendor accounts, though Bitrefill has not disclosed a total financial loss figure; it said it would cover any losses from its own operating capital rather than from customer balances. Bitrefill said it found no evidence that its full customer database was exfiltrated, and that KYC verification data, where required, is held only by an external provider and was not affected. The company said it took systems offline to contain the incident, worked with outside incident-response firms (reported as zeroShadow, SEAL911 and RecoverisTeam) and law enforcement, and that payments, stock and accounts had returned to normal by the time of disclosure.","heading":"March 2026 Cyberattack and Data Exposure","sources":[{"url":"https://decrypt.co/361462/crypto-gift-card-platform-bitrefill-hack-north-korean-groups","name":"Decrypt: 'Crypto Gift Card Platform Bitrefill Hack Tied to North Korean Groups'","type":"news_article","credibility":2},{"url":"https://www.theblock.co/news/regulation/2026-03-17-crypto-ecommerce-bitrefill-discloses-cyberattack-north-koreas-lazarus-potential-suspect-393974","name":"The Block: 'Crypto e-commerce firm Bitrefill discloses cyberattack, names North Korea's Lazarus Group as potential suspect'","type":"news_article","credibility":2},{"url":"https://www.teiss.co.uk/news/bitrefill-cyberattack-linked-to-suspected-north-korean-hackers-exposes-limited-customer-data-17231","name":"teiss: 'Bitrefill cyberattack linked to suspected North Korean hackers exposes limited customer data'","type":"news_article","credibility":2}],"severity":"high"},{"content":"Bitrefill's attribution of the attack to North Korean state-linked hacking groups is tentative rather than confirmed. In its incident report, as quoted by multiple outlets, Bitrefill said: 'we find many similarities between this attack and past cyberattacks by the DPRK Lazarus / Bluenoroff group,' citing malware signatures, on-chain tracing, and reused IP and email infrastructure as indicators. The Block's headline describes Lazarus as a 'potential suspect' and its body states the attack was 'likely perpetrated by the state-sponsored North Korean hacking collective Lazarus Group.' No government agency, law-enforcement body, or independent blockchain-forensics firm has published a confirmed attribution of the Bitrefill breach to Lazarus or BlueNoroff; the claim rests on Bitrefill's own tentative wording as reported by news outlets.","heading":"Lazarus Group Attribution","sources":[{"url":"https://decrypt.co/361462/crypto-gift-card-platform-bitrefill-hack-north-korean-groups","name":"Decrypt: 'Crypto Gift Card Platform Bitrefill Hack Tied to North Korean Groups'","type":"news_article","credibility":2},{"url":"https://www.theblock.co/news/regulation/2026-03-17-crypto-ecommerce-bitrefill-discloses-cyberattack-north-koreas-lazarus-potential-suspect-393974","name":"The Block: 'Crypto e-commerce firm Bitrefill discloses cyberattack, names North Korea's Lazarus Group as potential suspect'","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Bitrefill is an e-commerce platform that allows users to purchase gift cards, mobile phone top-ups, and eSIM data using cryptocurrency. Bitrefill's own blog states the company was 'Founded in 2015, by Sergej Kotliar and co-founders Michael Grünberger and Michel Gustavsson,' though third-party sources including CB Insights and a CoinDesk profile instead give 2014 as the founding year; the exact year is disputed across Bitrefill's own materials and outside coverage. The service is operated by Airfill Prepaid AB, registered in Stockholm, Sweden, according to Bitrefill's website footer. As of the company's current homepage, Bitrefill advertises '8k+ products in 180+ countries.' An earlier CoinDesk profile, describing the service as of 2019, cited availability in 170 countries and more than 1,650 partner businesses; a widely circulated figure of '900+ carriers' across '170+ countries' traced back to a third-party project directory (Solana Compass) rather than to Bitrefill itself, and could not be independently verified against any Bitrefill-published figure. Readers should treat specific carrier and country counts as approximate and subject to change, since Bitrefill's own current site does not publish a carrier total.","heading":"Company Overview","sources":[{"url":"https://www.bitrefill.com/blog/bitrefill-raises-2m-to-grow-team-and-advance-lightning-network-services/","name":"Bitrefill blog: funding announcement naming founders","type":"official","credibility":1},{"url":"https://www.bitrefill.com/","name":"Bitrefill homepage","type":"official","credibility":1},{"url":"https://www.coindesk.com/learn/bitrefill","name":"CoinDesk Learn: Bitrefill profile","type":"news_article","credibility":2}],"severity":"low"},{"content":"Bitrefill holds a Trustpilot rating described by the platform as 4.5 out of 5 across roughly 2,700-3,000 reviews, with the company reportedly replying to all negative reviews. Alongside largely positive reviews praising speed and ease of use, a recurring minority of complaints describe gift card or mobile top-up codes that arrived already redeemed or non-functional, and some reviewers report slow or unresponsive customer support before a resolution was reached. These are individual, unverified customer accounts rather than findings from a regulator or independent investigation, and Trustpilot itself states it does not verify the substance of reviewers' claims. This section should be treated as low-confidence, Tier 3 sourcing.","heading":"Customer Complaints","sources":[{"url":"https://uk.trustpilot.com/review/bitrefill.com","name":"Trustpilot: Bitrefill reviews","type":"social_media","credibility":3}],"severity":"low"},{"content":"No lawsuit, class action, regulatory enforcement action, or fine related to Bitrefill or the March 2026 breach was found in searches of news coverage and legal-industry trackers as of this investigation. This absence of findings is not proof that no such action exists; it reflects the result of available searches at the time of writing.","heading":"Regulatory and Legal Status","sources":[],"severity":"low"}],"timeline":[{"date":"2014","event":"Bitrefill founded by Sergej Kotliar (CoinDesk and other third-party sources give 2014; Bitrefill's own blog gives 2015).","source":"CoinDesk Learn: Bitrefill profile","source_url":"https://www.coindesk.com/learn/bitrefill"},{"date":"2026-03-01","event":"Cyberattack begins, reportedly via a compromised employee laptop; attackers access internal systems and some hot wallets.","source":"Decrypt","source_url":"https://decrypt.co/361462/crypto-gift-card-platform-bitrefill-hack-north-korean-groups","date_evidence":"On March 1, 2026, Bitrefill was the target of a cyberattack."},{"date":"2026-03-17","event":"Bitrefill publicly discloses the breach, stating about 18,500 purchase records were affected and tentatively attributing the attack to North Korea's Lazarus/BlueNoroff groups.","source":"The Block","source_url":"https://www.theblock.co/news/regulation/2026-03-17-crypto-ecommerce-bitrefill-discloses-cyberattack-north-koreas-lazarus-potential-suspect-393974","date_evidence":"Regulation•March 17, 2026, 1:07PM EDT"}],"sources_used":[{"url":"https://decrypt.co/361462/crypto-gift-card-platform-bitrefill-hack-north-korean-groups","name":"Decrypt: 'Crypto Gift Card Platform Bitrefill Hack Tied to North Korean Groups'","type":"news_article","archive_url":"http://web.archive.org/web/20261011092006/https://decrypt.co/361462/crypto-gift-card-platform-bitrefill-hack-north-korean-groups","credibility":2,"archive_timestamp":"2026-10-11T09:20:06+00:00"},{"url":"https://www.theblock.co/news/regulation/2026-03-17-crypto-ecommerce-bitrefill-discloses-cyberattack-north-koreas-lazarus-potential-suspect-393974","name":"The Block: 'Crypto e-commerce firm Bitrefill discloses cyberattack, names North Korea's Lazarus Group as potential suspect'","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://www.teiss.co.uk/news/bitrefill-cyberattack-linked-to-suspected-north-korean-hackers-exposes-limited-customer-data-17231","name":"teiss: 'Bitrefill cyberattack linked to suspected North Korean hackers exposes limited customer data'","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://www.bitrefill.com/blog/bitrefill-raises-2m-to-grow-team-and-advance-lightning-network-services/","name":"Bitrefill blog: funding announcement naming founders","type":"official","archive_url":null,"credibility":1,"archive_timestamp":null},{"url":"https://www.bitrefill.com/","name":"Bitrefill homepage","type":"official","archive_url":null,"credibility":1,"archive_timestamp":null},{"url":"https://www.coindesk.com/learn/bitrefill","name":"CoinDesk Learn: Bitrefill profile","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://uk.trustpilot.com/review/bitrefill.com","name":"Trustpilot: Bitrefill reviews","type":"social_media","archive_url":"http://web.archive.org/web/20260128233842/https://uk.trustpilot.com/review/bitrefill.com","credibility":3,"archive_timestamp":"2026-01-28T23:38:42+00:00"}],"source_tags":[],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-06-04T03:35:33.340621+00:00","updated_at":"2026-11-03T11:50:01.171804+00:00"},"source_quality":{"total":7,"tier1":0,"tier2":3,"tier3":0,"unrated":4},"follower_count":null,"content_updated_at":"2026-11-03T05:59:21.211Z","last_fact_checked_at":"2026-11-03T05:59:19.809Z","fact_check_next_allowed_at":"2026-11-10T05:59:19.809Z","update_next_allowed_at":"2026-11-10T04:23:36.656Z"}