Skip to main content
AVOID.NET
Sign in

Bitrefill

avoid.net/bitrefill→52/100·72% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·5wLpom…7izC

Summary

Bitrefill is a Stockholm-headquartered crypto e-commerce platform founded in 2014 that allows users to purchase gift cards, eSIMs, and phone top-ups with Bitcoin and other cryptocurrencies. On March 1, 2026, the company suffered a confirmed cyberattack in which attackers compromised an employee laptop, escalated access to production infrastructure and hot wallets, drained an undisclosed amount of cryptocurrency, and exfiltrated approximately 18,500 purchase records. Bitrefill publicly attributed the attack to North Korea's Lazarus Group (Bluenoroff subgroup) based on malware signatures, on-chain tracing, and reuse of IP and email addresses consistent with prior DPRK-linked operations.

Connected Entities

1 entities
Protocols
⌂Bitrefill
Relationships
    Have evidence about Bitrefill?

    Timeline(4 events)

    2014

    Bitrefill founded in Stockholm, Sweden by Sergej Kotliar, Patric Stiller, Michel Gustavsson, and Michael Grünberger.

    Crunchbase / Coin Bureau

    March 2026

    Cyberattack initiated: attackers compromised an employee laptop and extracted a legacy credential, escalating access to Bitrefill's production infrastructure, databases, and hot wallets. Funds were drained and approximately 18,500 purchase records were accessed. Bitrefill detected the breach via suspicious gift card supply chain activity and anomalous wallet movement and immediately took all systems offline.

    Bitrefill official statement / CoinDesk

    17 March 2026

    Bitrefill publicly discloses the March 1 breach and attributes it to North Korea's Lazarus Group (Bluenoroff subgroup) based on malware signatures, on-chain tracing, and reused IP and email addresses consistent with prior DPRK operations.

    CoinDesk / Bitcoin Magazine / SC Media

    18 March 2026

    Multiple major crypto and cybersecurity outlets report on Bitrefill's disclosure. The company confirms it is cooperating with law enforcement and that operations have largely been restored. Bitrefill commits to covering all financial losses from operational capital.

    Bleeping Computer / The Block / Cryptopolitan / FinanceFeeds
    Provenance & Audit Trail
    Anchored on SolanaVerify on-chain17 Wayback Archives

    Decision Log

    This investigation is cryptographically anchored to the Solana blockchain (5 events). 17 of 20 cited source URLs have an Internet Archive snapshot.

    full audit log →version history →

    model: claude-sonnet-4-6

    generated: 6/4/2026, 3:35:33 AM

    last updated: 8/11/2026, 9:02:19 PM

    4 views

    avoid.net — verified advice for a post-truth world