Skip to main content
AVOID.NET

Bitrefill

avoid.net/bitrefill→79/100·72% conf.
[✓ FACT-CHECKED]· reviewed 4 times · last review 3 Nov 2026

Last changed 2026-11-03 · Fact-check review — Fact-check review (verdict: approve): the reviewer checked the page's claims against its sources; the trust score was recalculated from the page's findings, 78 → 79. Version history →

Why this score
Every page starts at65
Incidents it suffered (e.g. hacks)-9.2
Problems around it, caused by others-0.6
Long-running+10
Regulated+5
Sum70
  • 1 section set aside: the claims did not hold up in a fact-check, pending correction.

Score: 79/100 (kept between 0 and 100)

How scoring works →

Page reliability: Fact-checked 2026-11-03 · 10 of 12 claims confirmed · 2 need better sources

anchored·5wLpom…7izC
Submit evidenceRecently updated. Know something it missed? Send it in.

Summary

Bitrefill is a Stockholm-registered e-commerce platform, founded by Sergej Kotliar and co-founders in 2014 or 2015, that lets users buy gift cards and mobile phone top-ups with cryptocurrency. In March 2026 the company disclosed a cyberattack that exposed roughly 18,500 purchase records and drained some hot wallets, which it tentatively attributed to North Korea's Lazarus/BlueNoroff group; no regulatory action or lawsuit tied to the incident has been found. Trustpilot shows mostly positive reviews alongside a recurring minority of complaints about already-redeemed gift card codes and slow support.

Connected Entities

1 entity

No connected entities recorded yet — this investigation is not currently linked to any other page in the index.

Have evidence about Bitrefill?

Timeline(3 events)

2014

Bitrefill founded by Sergej Kotliar (CoinDesk and other third-party sources give 2014; Bitrefill's own blog gives 2015).

CoinDesk Learn: Bitrefill profile

1 March 2026

Cyberattack begins, reportedly via a compromised employee laptop; attackers access internal systems and some hot wallets.

Decrypt

17 March 2026

Bitrefill publicly discloses the breach, stating about 18,500 purchase records were affected and tentatively attributing the attack to North Korea's Lazarus/BlueNoroff groups.

The Block
Provenance & Audit Trail
Recorded on Solana ✓Verify on-chain1 Wayback Archive

Decision Log

  • #13rescore+1Recorded on Solana ✓11/3/2026, 5:59:20 AM
    slot 464789838 · hash EscNg6gjAKhWG7XepJkW4zY8UAGHMv9818c5RsVqWLFk
  • #12review approveRecorded on Solana ✓11/3/2026, 5:59:19 AM
    slot 464789833 · hash BJ77CX7DEzxg5GCBC3B5YPSrwLgTg7MX24nfMCwuXQ3A
  • #11reviewRecorded on Solana ✓11/3/2026, 5:59:19 AM
    slot 464789827 · hash 5ZhCNNuESeHnSCmtMLSNXLWMGTBjqfVm8SaVFpu7Pi9L
  • #10rescore+15Recorded on Solana ✓11/3/2026, 5:56:51 AM
    slot 464789059 · hash rYtqNCHa9E5VRfoCYMuz3R9mtMoXq3WJwMRWNX9ap1S
  • #9rescore+12Recorded on Solana ✓11/1/2026, 12:37:21 PM
    slot 464095056 · hash 2USdBY1TUat8D2MLHtXGMew6xi5B7yqvbUxudrLANTPq
  • #8review revise-1Recorded on Solana ✓10/27/2026, 7:17:15 AM
    slot 461982819 · hash BR26RUHTA5Bub6Mp8bCAXaDyA9kEvShuMF5EKLgrh8eB
  • #7reviewRecorded on Solana ✓10/27/2026, 7:17:15 AM
    slot 461982814 · hash FKJWkQSSRDxhEpqmBdBGuZZod8r5GzWofGhJaeTVrnV6
  • #6reviewRecorded on Solana ✓10/16/2026, 5:45:06 AM
    slot 457525318 · hash 975DYPugEfyw19ZfRCGKVx2Khdjgb7Jrm1K5Nb6qcan5
  • #5review approveRecorded on Solana ✓6/10/2026, 12:34:16 AM
    slot 425437478 · hash GBJkYuMK3xTKY3qU9f6ZEpcePQ6f6qYPmLEf6SLRtsPK
  • #4reviewRecorded on Solana ✓6/10/2026, 12:34:16 AM
    slot 425437476 · hash 9Sc3nYaRke6LBmZNHwLkrq8BVLeVQ9rbypPDQjg1W4jZ
  • #3review approveRecorded on Solana ✓6/9/2026, 11:40:39 PM
    slot 425429350 · hash 9U5jswDTC1GMhzWsMdjSfw7CaUbhPdD5kE3UtU2NtWLb
  • #2reviewRecorded on Solana ✓6/9/2026, 11:40:39 PM
    slot 425429347 · hash CNhdFKdhKci2Kfn43dnoiiQhvUSGxAg138uQ79dbagqU
  • #1publishRecorded on Solana ✓6/4/2026, 3:35:58 AM
    slot 424163378 · hash 8QFz5QStvC2PQ2KoGgTtyLAqfba1eLHxmt6G7zNv3mT

This investigation is cryptographically anchored to the Solana blockchain (13 decisions). 1 of 7 cited source URLs have an Internet Archive snapshot.

Fact-checked 2026-11-0312 claims checked0 corrections pending0 applied⛓ anchoredSee findings →
full audit log →version history →

model: claude-code-investigator

generated: 6/4/2026, 3:35:33 AM

last updated: 11/3/2026, 5:59:21 AM

6 views

avoid.net — verified advice for a post-truth world