Audit log

Every state-changing event for Bitrefill: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-06-04 03:35:58Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 424,163,378

   sig

   5wLpomPMQSs5…EDUZ7izCcopyexplorer ↗

   hash

   8QFz5QStvC2P…G7zNv3mTcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (19986 B) ▸

   {"actor":"system:backfill","investigation_id":"8038ecc2-39f1-4530-bfdf-f87bf4b49de2","kind":"publish","page_slug":"bitrefill","published_at":"2026-06-04T03:35:58.419Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Bitrefill","sections":[{"content":"Bitrefill was founded in 2014 and is headquartered in Stockholm, Sweden. The company was formerly incorporated as Pupot AB. Its core product is a crypto e-commerce storefront enabling users to spend Bitcoin, Ethereum, Litecoin, Dogecoin, Solana, USDC, USDT, and other cryptocurrencies on digital gift cards spanning major global brands including Amazon, Walmart, Starbucks, Apple, Netflix, Spotify, and Uber, as well as prepaid mobile top-ups and eSIMs. The platform supports Lightning Network payments for sub-second transaction finality and operates in over 100 countries. Bitrefill explicitly does not require mandatory Know Your Customer (KYC) verification for most purchases, storing only limited customer information and keeping verification data with external providers. The company self-describes as well-funded and profitable.","heading":"Company Overview","severity":"low","sources":[{"credibility":1,"name":"Bitrefill official website","type":"official","url":"https://www.bitrefill.com/us/en/"},{"credibility":2,"name":"Bitrefill company profile — Crunchbase","type":"other","url":"https://www.crunchbase.com/organization/bitrefill"},{"credibility":2,"name":"Stockholm-based cryptocurrency startup Bitrefill raises $2 million — Tech.eu","type":"news_article","url":"https://tech.eu/2019/06/13/stockholm-based-cryptocurrency-startup-bitrefill-raises-2-million/"}]},{"content":"On March 1, 2026, Bitrefill was the target of a cyberattack subsequently attributed to the North Korean state-sponsored Lazarus Group (specifically the Bluenoroff financial-crime subunit). The initial access vector was a compromised employee laptop from which attackers exfiltrated a legacy credential. That credential provided access to a snapshot containing production secrets, which the attackers used to escalate privileges across Bitrefill's infrastructure, including parts of its database and certain cryptocurrency hot wallets. Bitrefill first detected the intrusion by noticing suspicious purchasing patterns with certain gift card suppliers, indicating that supply lines were being exploited. Simultaneously, hot wallets were found to be drained, with funds transferred to attacker-controlled addresses. Upon identifying the breach, Bitrefill took all systems offline as a containment measure. The company's official incident report was published on X (formerly Twitter) on March 17–18, 2026. Most systems, including payments, stock management, and user accounts, were restored to normal operation by approximately March 5, 2026, with sales volumes returning to normal levels thereafter.","heading":"March 2026 Cyberattack — Attack Vector and Timeline","severity":"critical","sources":[{"credibility":1,"name":"Bitrefill blames North Korea-linked Lazarus hacker group for compromising 18,500 purchase records — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2026/03/18/bitrefill-accuses-north-korea-linked-lazarus-hacker-group-for-compromising-18-500-purchase-records"},{"credibility":1,"name":"Bitrefill blames North Korean Lazarus group for cyberattack — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/bitrefill-blames-north-korean-lazarus-group-for-cyberattack/"},{"credibility":1,"name":"Crypto e-commerce platform Bitrefill accuses North Korea of stealing 18,500 purchase records — The Record (Recorded Future)","type":"news_article","url":"https://therecord.media/crypto-platform-accuses-north-korea-hack"},{"credibility":1,"name":"Crypto Gift Card Platform Bitrefill Discloses Hack, Points Finger at North Korean Groups — Decrypt","type":"news_article","url":"https://decrypt.co/361462/crypto-gift-card-platform-bitrefill-hack-north-korean-groups"}]},{"content":"Attackers accessed approximately 18,500 purchase records during the breach. Each record contained limited customer data: email addresses, cryptocurrency payment addresses, and metadata including IP addresses. For approximately 1,000 of those purchase records, transactions required customers to supply a name; that information was stored in encrypted form in the database. Because the attackers may have obtained access to encryption keys, Bitrefill stated it was treating those approximately 1,000 name-associated records as potentially compromised and notified affected customers directly by email. Bitrefill emphasized that it does not require full KYC and stores very little personal data, with sensitive identity verification maintained by external providers rather than on company systems. No evidence of a full database exfiltration was reported; attackers conducted a limited number of targeted queries focused on cryptocurrency inventory and gift card stock. The specific monetary value of cryptocurrency drained from hot wallets was not disclosed by Bitrefill in its public incident report.","heading":"Data Exposure and Customer Impact","severity":"high","sources":[{"credibility":1,"name":"Bitrefill blames North Korean Lazarus group for cyberattack — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/bitrefill-blames-north-korean-lazarus-group-for-cyberattack/"},{"credibility":1,"name":"Crypto e-commerce platform Bitrefill accuses North Korea of stealing 18,500 purchase records — The Record","type":"news_article","url":"https://therecord.media/crypto-platform-accuses-north-korea-hack"},{"credibility":1,"name":"Bitrefill blames North Korea-linked Lazarus hacker group — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2026/03/18/bitrefill-accuses-north-korea-linked-lazarus-hacker-group-for-compromising-18-500-purchase-records"},{"credibility":2,"name":"Crypto Platform Bitrefill Hacked: 18,500 User Records Exposed — CoinPedia","type":"news_article","url":"https://coinpedia.org/news/bitrefill-hack-lazarus-group-suspected-in-major-crypto-cyberattack-18500-users-affected/"}]},{"content":"Bitrefill attributed the March 1, 2026 attack to the DPRK Lazarus Group, and specifically to its Bluenoroff financial-crime subunit, based on several categories of evidence gathered during its internal investigation. The company identified similarities in modus operandi and the specific malware used, on-chain tracing of funds to addresses associated with prior Lazarus Group operations, and reused IP addresses and email addresses consistent with prior DPRK Bluenoroff campaigns against other cryptocurrency companies. Bitrefill stated it engaged cybersecurity experts, blockchain analysts, and law enforcement in its investigation. Independent security researchers at Cyble also analyzed the incident in the context of Lazarus Group's broader campaign against cryptocurrency platforms. The Lazarus Group and its Bluenoroff subunit have been attributed by U.S. government agencies to numerous major cryptocurrency thefts, including the 2022 Ronin Network hack ($625 million), the 2022 Harmony Horizon Bridge hack ($100 million), the 2023 Atomic Wallet breach, and the 2025 Bybit hack ($1.5 billion, the largest single crypto theft on record). North Korean state-sponsored hackers are estimated to have stolen over $6.8 billion in cryptocurrency since 2022. It should be noted that Bitrefill's attribution is based on its own investigation and external analysis; no independent confirmation from U.S. or allied government agencies has been publicly reported as of the investigation date.","heading":"Attribution to Lazarus Group / DPRK Bluenoroff","severity":"critical","sources":[{"credibility":1,"name":"Bitrefill blames North Korea-linked Lazarus hacker group — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2026/03/18/bitrefill-accuses-north-korea-linked-lazarus-hacker-group-for-compromising-18-500-purchase-records"},{"credibility":1,"name":"Bitrefill blames North Korean Lazarus group — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/bitrefill-blames-north-korean-lazarus-group-for-cyberattack/"},{"credibility":2,"name":"Lazarus Group Bitrefill Cyberattack Crypto Threat — Cyble","type":"research","url":"https://cyble.com/blog/lazarus-group-bitrefill-cyberattack/"},{"credibility":3,"name":"North Korea's $6 Billion Crypto Crime Spree — Crypto Impact Hub","type":"news_article","url":"https://cryptoimpacthub.com/north-korea-6-billion-crypto-theft-dprk-lazarus-2026/"}]},{"content":"Following detection of the breach, Bitrefill immediately took all systems offline as a containment measure, then restored services in phases. The company stated it would cover all financial losses — including drained hot wallet funds and stolen gift card inventory — from its operational capital, without passing any losses to customers. In its post-mortem, Bitrefill described the incident as its first major security breach in over a decade of operation. Remediation measures implemented or announced include: expanded external penetration testing and security reviews; tighter access controls and privilege management; improved logging and monitoring systems; refined automated shutdown mechanisms; and updated incident response procedures. Bitrefill notified all customers whose records were accessed directly by email, including those with encrypted name data that was treated as potentially compromised. The company stated it was cooperating with law enforcement. As of the post-mortem publication on March 18, 2026, sales volumes had returned to normal.","heading":"Company Response and Remediation","severity":"medium","sources":[{"credibility":1,"name":"Bitrefill blames North Korean Lazarus group — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/bitrefill-blames-north-korean-lazarus-group-for-cyberattack/"},{"credibility":1,"name":"Crypto e-commerce platform Bitrefill accuses North Korea — The Record","type":"news_article","url":"https://therecord.media/crypto-platform-accuses-north-korea-hack"},{"credibility":2,"name":"Bitrefill blames North Korean hackers for March 1 exploit — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/bitrefill-north-korean-hackers-exploit/"}]},{"content":"The attack exploited a legacy credential retrieved from a compromised employee laptop — a class of vulnerability associated with inadequate credential rotation and lifecycle management. The presence of credentials with access to production secrets on an employee endpoint represents a systemic security control failure, regardless of the sophistication of the external attacker. Bitrefill acknowledged this failure and described remediation steps including tighter access controls. The broader Lazarus Group / Bluenoroff attack pattern documented by security researchers involves initial access via compromised employee devices, often through social engineering (including fake job offers, fraudulent calendar invites, and ClickFix-style clipboard injection attacks), followed by lateral movement using harvested credentials. Whether the Bitrefill employee laptop was compromised via social engineering or another method was not publicly disclosed.","heading":"Legacy Credential and Insider Threat Risk","severity":"high","sources":[{"credibility":1,"name":"Bitrefill blames North Korean Lazarus group — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/bitrefill-blames-north-korean-lazarus-group-for-cyberattack/"},{"credibility":1,"name":"North Korea-linked actor targets Web3 execs in social-engineering campaign — Cybersecurity Dive","type":"news_article","url":"https://www.cybersecuritydive.com/news/north-korea-web3-execs-social-engineering-hacker/818639/"},{"credibility":2,"name":"BlueNoroff Group: The Financial Cybercrime Arm of Lazarus — Picus Security","type":"research","url":"https://www.picussecurity.com/resource/blog/bluenoroff-group-the-financial-cybercrime-arm-of-lazarus"}]},{"content":"Bitrefill has operated since 2014 and raised a total of approximately $2.35 million in disclosed funding, with investors including Draper Associates, BnkToTheFuture, Charlie Lee (creator of Litecoin), Coin Ninja, and Fulgur Ventures. The company characterized the March 2026 incident as its first major security breach in more than a decade of operation. No prior regulatory actions, enforcement proceedings, or significant prior security incidents involving Bitrefill have been identified through public records as of the investigation date. The company's no-mandatory-KYC model has been noted by some analysts as a dual-edged characteristic — it reduces customer data exposure in a breach scenario (as demonstrated here) but also reduces auditability of users.","heading":"Operational History and Prior Security Record","severity":"low","sources":[{"credibility":2,"name":"Stockholm-based cryptocurrency startup Bitrefill raises $2 million — Tech.eu","type":"news_article","url":"https://tech.eu/2019/06/13/stockholm-based-cryptocurrency-startup-bitrefill-raises-2-million/"},{"credibility":2,"name":"Bitrefill — Crunchbase","type":"other","url":"https://www.crunchbase.com/organization/bitrefill"},{"credibility":1,"name":"Bitrefill blames North Korean Lazarus group — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/bitrefill-blames-north-korean-lazarus-group-for-cyberattack/"}]}],"sources_used":[{"credibility":1,"name":"Bitrefill blames North Korea-linked Lazarus hacker group for compromising 18,500 purchase records — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2026/03/18/bitrefill-accuses-north-korea-linked-lazarus-hacker-group-for-compromising-18-500-purchase-records"},{"credibility":1,"name":"Bitrefill blames North Korean Lazarus group for cyberattack — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/bitrefill-blames-north-korean-lazarus-group-for-cyberattack/"},{"credibility":1,"name":"Crypto e-commerce platform Bitrefill accuses North Korea of stealing 18,500 purchase records — The Record (Recorded Future News)","type":"news_article","url":"https://therecord.media/crypto-platform-accuses-north-korea-hack"},{"credibility":1,"name":"Crypto Gift Card Platform Bitrefill Discloses Hack, Points Finger at North Korean Groups — Decrypt","type":"news_article","url":"https://decrypt.co/361462/crypto-gift-card-platform-bitrefill-hack-north-korean-groups"},{"credibility":2,"name":"Crypto Platform Bitrefill Hacked: 18,500 User Records Exposed in Cyberattack — CoinPedia","type":"news_article","url":"https://coinpedia.org/news/bitrefill-hack-lazarus-group-suspected-in-major-crypto-cyberattack-18500-users-affected/"},{"credibility":2,"name":"Lazarus Group Bitrefill Cyberattack Crypto Threat — Cyble","type":"research","url":"https://cyble.com/blog/lazarus-group-bitrefill-cyberattack/"},{"credibility":2,"name":"Bitrefill hack linked to Lazarus: what it reveals about crypto risks — Invezz","type":"news_article","url":"https://invezz.com/news/2026/03/18/bitrefill-hack-linked-to-lazarus-what-it-reveals-about-crypto-risks/"},{"credibility":2,"name":"Bitrefill blames North Korean hackers for March 1 exploit, commits to cover losses — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/bitrefill-north-korean-hackers-exploit/"},{"credibility":1,"name":"Bitrefill official website","type":"official","url":"https://www.bitrefill.com/us/en/"},{"credibility":2,"name":"Bitrefill — Crunchbase company profile","type":"other","url":"https://www.crunchbase.com/organization/bitrefill"},{"credibility":2,"name":"Stockholm-based cryptocurrency startup Bitrefill raises $2 million — Tech.eu","type":"news_article","url":"https://tech.eu/2019/06/13/stockholm-based-cryptocurrency-startup-bitrefill-raises-2-million/"},{"credibility":1,"name":"North Korea-linked actor targets Web3 execs in social-engineering campaign — Cybersecurity Dive","type":"news_article","url":"https://www.cybersecuritydive.com/news/north-korea-web3-execs-social-engineering-hacker/818639/"},{"credibility":2,"name":"BlueNoroff Group: The Financial Cybercrime Arm of Lazarus — Picus Security","type":"research","url":"https://www.picussecurity.com/resource/blog/bluenoroff-group-the-financial-cybercrime-arm-of-lazarus"},{"credibility":2,"name":"Sergej Kotliar — Founder, CEO at Bitrefill — Crunchbase","type":"other","url":"https://www.crunchbase.com/person/sergej-kotliar"}],"summary":"Bitrefill is a Stockholm-based cryptocurrency e-commerce platform founded in 2014 that allows users to purchase digital gift cards, eSIMs, and mobile top-ups using Bitcoin and other cryptocurrencies across more than 100 countries. On March 1, 2026, Bitrefill suffered a significant cyberattack attributed to the North Korea-linked Lazarus Group (Bluenoroff subunit), in which attackers compromised an employee laptop, escalated access via legacy credentials, drained hot wallets, and exposed approximately 18,500 customer purchase records. Bitrefill stated it would cover all financial losses from operational capital and characterized this as the platform's first major security incident in over a decade of operation.","timeline":[{"date":"2014-01-01","event":"Bitrefill founded in Stockholm, Sweden (formerly incorporated as Pupot AB) by Sergej Kotliar and co-founders","source":"Crunchbase / Tech.eu","source_url":"https://www.crunchbase.com/organization/bitrefill"},{"date":"2019-06-13","event":"Bitrefill raises $2 million seed round led by Coin Ninja, with participation from Charlie Lee, Fulgur Ventures, and BnkToTheFuture; total disclosed funding reaches approximately $2.35 million","source":"Tech.eu","source_url":"https://tech.eu/2019/06/13/stockholm-based-cryptocurrency-startup-bitrefill-raises-2-million/"},{"date":"2026-03-01","event":"Cyberattack begins: attackers compromise an employee laptop, exfiltrate legacy credentials, escalate to production secrets, drain hot wallets, and access approximately 18,500 purchase records; Bitrefill detects intrusion via anomalous supplier purchasing patterns and takes all systems offline","source":"CoinDesk / BleepingComputer / The Record","source_url":"https://www.bleepingcomputer.com/news/security/bitrefill-blames-north-korean-lazarus-group-for-cyberattack/"},{"date":"2026-03-02","event":"Bitrefill publicly discloses a security breach and begins taking services offline; announces investigation is underway","source":"BleepingComputer","source_url":"https://www.bleepingcomputer.com/news/security/bitrefill-blames-north-korean-lazarus-group-for-cyberattack/"},{"date":"2026-03-05","event":"Most Bitrefill systems — including payments, stock management, and user accounts — reported restored to normal operation","source":"The Record","source_url":"https://therecord.media/crypto-platform-accuses-north-korea-hack"},{"date":"2026-03-17","event":"Bitrefill publishes formal incident report on X (formerly Twitter), attributing the attack to DPRK Lazarus Group / Bluenoroff based on malware signatures, on-chain tracing, and reused attacker infrastructure","source":"CoinDesk / Decrypt / BleepingComputer","source_url":"https://www.coindesk.com/markets/2026/03/18/bitrefill-accuses-north-korea-linked-lazarus-hacker-group-for-compromising-18-500-purchase-records"},{"date":"2026-03-18","event":"Major media coverage of Bitrefill's Lazarus Group attribution published, including CoinDesk, BleepingComputer, The Record, and Decrypt; Bitrefill states losses will be covered from operational capital and sales volumes have normalized","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2026/03/18/bitrefill-accuses-north-korea-linked-lazarus-hacker-group-for-compromising-18-500-purchase-records"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 46db36ff-9198-4b31-a51d-35ccc24ab14ccopy
2. #2reviewby reviewerreviewer

   2026-06-09 23:40:39Z
   Score: 52 → 52 (no score change)
   The Bitrefill investigation page is well-sourced and broadly accurate. All major factual claims regarding the March 2026 cyberattack — attack date, vector, data exposure scope, attribution rationale, recovery timeline, and Bitrefill's financial commitments — are confirmed by Tier-1 sources including BleepingComputer, The Record, and CoinDesk. One claim is partially supported: the page asserts North Korean hackers have stolen 'over $6.8 billion in cryptocurrency since 2022,' but independent sources consistently cite approximately $6.75 billion since 2016, making the time-window and amount both slightly inaccurate. One claim (the Cyble independent analysis) is unverifiable due to a 403 access error on the cited URL, though the URL itself is not dead. No link rot or direct contradictions with reputable sources were found.
   anchoranchored

   chain

   ●mainnet-betaslot 425,429,347

   sig

   38esFGiG1ZpS…NzLUB67Hcopyexplorer ↗

   hash

   CNhdFKdhKci2…79dbagqUcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1175 B) ▸

   {"actor":"reviewer","decided_at":"2026-06-09T23:40:39.622Z","decision":"review","investigation_id":"8038ecc2-39f1-4530-bfdf-f87bf4b49de2","new_score":52,"page_slug":"bitrefill","prev_score":52,"reason":"The Bitrefill investigation page is well-sourced and broadly accurate. All major factual claims regarding the March 2026 cyberattack — attack date, vector, data exposure scope, attribution rationale, recovery timeline, and Bitrefill's financial commitments — are confirmed by Tier-1 sources including BleepingComputer, The Record, and CoinDesk. One claim is partially supported: the page asserts North Korean hackers have stolen 'over $6.8 billion in cryptocurrency since 2022,' but independent sources consistently cite approximately $6.75 billion since 2016, making the time-window and amount both slightly inaccurate. One claim (the Cyble independent analysis) is unverifiable due to a 403 access error on the cited URL, though the URL itself is not dead. No link rot or direct contradictions with reputable sources were found.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision c848577b-cdd9-4658-bccb-1e57105b7502copy
3. #3review approveby judgejudge

   2026-06-09 23:40:39Z
   Score: 52 → 52 (no score change)
   The review evaluated 23 claims and found 21 confirmed, 1 partially supported, and 1 unverifiable — yielding a disputed_pct of 8.7%, which falls in the 0–10% approval band. The one partially supported claim (claim_findings[17]: DPRK aggregate theft cited as '$6.8B since 2022' versus independently reported ~$6.75B since 2016) is a minor contextual statistic, not a core allegation about Bitrefill's conduct or the March 2026 incident. The one unverifiable claim (claim_findings[22]: Cyble independent analysis) returned HTTP 403 but is not dead link rot, and Cyble is a known cybersecurity firm. All core incident facts — attack date, entry vector, data exposure scope, attribution basis, recovery timeline, and Bitrefill's financial commitments — are confirmed by multiple Tier-1 sources including BleepingComputer, The Record, and CoinDesk. No link rot, stale citations, or direct factual contradictions were found. One high-priority coverage gap (on-chain tracing of drained funds) is noted for future expansion but does not affect approval.
   anchoranchored

   chain

   ●mainnet-betaslot 425,429,350

   sig

   4rLZN8kvQj9v…cDd698x6copyexplorer ↗

   hash

   9U5jswDTC1GM…tU2NtWLbcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1394 B) ▸

   {"actor":"judge","decided_at":"2026-06-09T23:40:39.622Z","decision":"review_approve","investigation_id":"8038ecc2-39f1-4530-bfdf-f87bf4b49de2","new_score":52,"page_slug":"bitrefill","prev_score":52,"reason":"The review evaluated 23 claims and found 21 confirmed, 1 partially supported, and 1 unverifiable — yielding a disputed_pct of 8.7%, which falls in the 0–10% approval band. The one partially supported claim (claim_findings[17]: DPRK aggregate theft cited as '$6.8B since 2022' versus independently reported ~$6.75B since 2016) is a minor contextual statistic, not a core allegation about Bitrefill's conduct or the March 2026 incident. The one unverifiable claim (claim_findings[22]: Cyble independent analysis) returned HTTP 403 but is not dead link rot, and Cyble is a known cybersecurity firm. All core incident facts — attack date, entry vector, data exposure scope, attribution basis, recovery timeline, and Bitrefill's financial commitments — are confirmed by multiple Tier-1 sources including BleepingComputer, The Record, and CoinDesk. No link rot, stale citations, or direct factual contradictions were found. One high-priority coverage gap (on-chain tracing of drained funds) is noted for future expansion but does not affect approval.","score_delta":0,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision c26c6806-c510-4941-9a8a-a9658c1bf112copy
4. #4reviewby reviewerreviewer

   2026-06-10 00:34:16Z
   Score: 52 → 52 (no score change)
   The Bitrefill investigation page is well-sourced and accurately represents the March 2026 cyberattack, with core facts — attack date, attack vector, records exposed, data types, attribution evidence, company response, and historical comparable hacks — confirmed across multiple Tier-1 sources. The most significant inaccuracies are: (1) the investor list includes Draper Associates, which is absent from the primary cited source (Tech.eu) and only appears in secondary aggregators; (2) the '$6.8 billion since 2022' North Korea theft figure conflates a cumulative all-time estimate with a post-2022 qualifier; and (3) the timeline's March 2 'breach disclosure' entry conflates Bitrefill's 'technical issues' announcement with a formal breach disclosure that came two weeks later. The Cyble source returned 403 Forbidden and could not be independently verified. No claims were found to be factually disputed by more credible sources.
   anchoranchored

   chain

   ●mainnet-betaslot 425,437,476

   sig

   4qLg6qCtSTZi…GXCav56Rcopyexplorer ↗

   hash

   9Sc3nYaRke6L…Qjg1W4jZcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1277 B) ▸

   {"actor":"reviewer","decided_at":"2026-06-10T00:34:16.729Z","decision":"review","investigation_id":"8038ecc2-39f1-4530-bfdf-f87bf4b49de2","new_score":52,"page_slug":"bitrefill","prev_score":52,"reason":"The Bitrefill investigation page is well-sourced and accurately represents the March 2026 cyberattack, with core facts — attack date, attack vector, records exposed, data types, attribution evidence, company response, and historical comparable hacks — confirmed across multiple Tier-1 sources. The most significant inaccuracies are: (1) the investor list includes Draper Associates, which is absent from the primary cited source (Tech.eu) and only appears in secondary aggregators; (2) the '$6.8 billion since 2022' North Korea theft figure conflates a cumulative all-time estimate with a post-2022 qualifier; and (3) the timeline's March 2 'breach disclosure' entry conflates Bitrefill's 'technical issues' announcement with a formal breach disclosure that came two weeks later. The Cyble source returned 403 Forbidden and could not be independently verified. No claims were found to be factually disputed by more credible sources.","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 502abb40-6a17-4ba8-ac54-c0f5007a2722copy
5. #5review approveby judgejudge

   2026-06-10 00:34:16Z
   Score: 52 → 52 (no score change)
   The reviewer examined 27 claims and found zero disputed. All core allegations — the March 1, 2026 attack date, Lazarus/Bluenoroff attribution, attack vector (legacy credential on compromised employee laptop), 18,500 records exposed, data types affected, hot wallet draining, and company commitment to cover losses — are confirmed by multiple Tier-1 sources including CoinDesk, BleepingComputer, and The Record. The five partially-supported findings involve minor imprecision: a dollar-figure variance on the Ronin hack (claim_findings[18]), a 'since 2022' qualifier that overstates DPRK aggregate theft scope (claim_findings[21]), a single-source March 5 restoration date (claim_findings[12]), Draper Associates investor attribution absent from the primary cited source (claim_findings[22]), and an initial announcement framed as 'technical issues' rather than a formal breach disclosure (claim_findings[27]). None affect the page's core factual record. The one unverifiable claim (claim_findings[17], Cyble blog returning 403) is supplementary context only and not load-bearing. Reviewer confidence of 0.87 and the absence of any high-priority coverage gaps support approval without score penalty.
   anchoranchored

   chain

   ●mainnet-betaslot 425,437,478

   sig

   31vcnDqdgtsc…LAE4oBFrcopyexplorer ↗

   hash

   GBJkYuMK3xTK…6SLRtsPKcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1548 B) ▸

   {"actor":"judge","decided_at":"2026-06-10T00:34:16.729Z","decision":"review_approve","investigation_id":"8038ecc2-39f1-4530-bfdf-f87bf4b49de2","new_score":52,"page_slug":"bitrefill","prev_score":52,"reason":"The reviewer examined 27 claims and found zero disputed. All core allegations — the March 1, 2026 attack date, Lazarus/Bluenoroff attribution, attack vector (legacy credential on compromised employee laptop), 18,500 records exposed, data types affected, hot wallet draining, and company commitment to cover losses — are confirmed by multiple Tier-1 sources including CoinDesk, BleepingComputer, and The Record. The five partially-supported findings involve minor imprecision: a dollar-figure variance on the Ronin hack (claim_findings[18]), a 'since 2022' qualifier that overstates DPRK aggregate theft scope (claim_findings[21]), a single-source March 5 restoration date (claim_findings[12]), Draper Associates investor attribution absent from the primary cited source (claim_findings[22]), and an initial announcement framed as 'technical issues' rather than a formal breach disclosure (claim_findings[27]). None affect the page's core factual record. The one unverifiable claim (claim_findings[17], Cyble blog returning 403) is supplementary context only and not load-bearing. Reviewer confidence of 0.87 and the absence of any high-priority coverage gaps support approval without score penalty.","score_delta":0,"sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 10b9d924-3d65-4a60-919f-50531ff138f3copy
6. #6reviewby reviewerreviewer

   2026-10-16 05:45:06Z
   Score: 52 → 52 (no score change)
   The page's core factual narrative — the March 1, 2026 breach, the ~18,500 exposed purchase records, the employee-laptop/legacy-credential attack vector, the Lazarus Group/Bluenoroff attribution and its stated basis, the March 17-18 disclosure timeline, the named security firms, and the broader $577M/76% DPRK crypto-theft statistic — is well supported by multiple independent tier-1 and tier-2 outlets (CoinDesk, The Block, SC Media) that corroborate Bitrefill's own public statements in detail. The page is also appropriately hedged where attribution is unconfirmed by any government body. The main weaknesses found are: (1) the four-name founder list (Kotliar, Stiller, Gustavsson, Grünberger) in the Company Overview and timeline does not match any single source consulted, including Bitrefill's own blog, which names only three different co-founders without Patric Stiller — flagged as partially_supported; and (2) two low-value cited sources (a dev.to blog post and databreach.io) are currently dead links, though neither carries unique factual weight since their claims are independently corroborated elsewhere on the page. No disputed or stale claims were identified. Coverage gaps exist around independent forensic confirmation of attribution, on-chain fund tracing, and Bitrefill's broader AML/regulatory risk profile as a no-KYC platform, none of which are addressed by the current page.
   anchoranchored

   chain

   ●mainnet-betaslot 457,525,318

   sig

   1MKjhq6ZSqmN…zXPSHzhdcopyexplorer ↗

   hash

   975DYPugEfyw…Nb6qcan5copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1993 B) ▸

   {"actor":"reviewer","artifact_identity":"0a58be417d7404c34c73d283bdbca524","decided_at":"2026-10-16T05:45:06.668Z","decision":"review","disputed_pct":0.0526,"findings_hash":"JCQ56UJdKSFYyxvrGrWvKC2ZKtYDS9aZTcKjQHYfxp1R","investigation_id":"8038ecc2-39f1-4530-bfdf-f87bf4b49de2","mode":"findings_only","new_score":52,"page_content_hash":"881751ee9aba6cbeb746dd44fb93863ee4e63c92e1c609e721e7137edbeb6a07","page_slug":"bitrefill","prev_score":52,"reason":"The page's core factual narrative — the March 1, 2026 breach, the ~18,500 exposed purchase records, the employee-laptop/legacy-credential attack vector, the Lazarus Group/Bluenoroff attribution and its stated basis, the March 17-18 disclosure timeline, the named security firms, and the broader $577M/76% DPRK crypto-theft statistic — is well supported by multiple independent tier-1 and tier-2 outlets (CoinDesk, The Block, SC Media) that corroborate Bitrefill's own public statements in detail. The page is also appropriately hedged where attribution is unconfirmed by any government body. The main weaknesses found are: (1) the four-name founder list (Kotliar, Stiller, Gustavsson, Grünberger) in the Company Overview and timeline does not match any single source consulted, including Bitrefill's own blog, which names only three different co-founders without Patric Stiller — flagged as partially_supported; and (2) two low-value cited sources (a dev.to blog post and databreach.io) are currently dead links, though neither carries unique factual weight since their claims are independently corroborated elsewhere on the page. No disputed or stale claims were identified. Coverage gaps exist around independent forensic confirmation of attribution, on-chain fund tracing, and Bitrefill's broader AML/regulatory risk profile as a no-KYC platform, none of which are addressed by the current page.","score_delta":0,"sequence_num":6,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d5235c76-2bbf-48a1-ab07-d018799509c4copy
7. #7reviewby reviewerreviewer

   2026-10-27 07:17:15Z
   Score: 52 → 52 (no score change)
   The incident narrative (date, vector, 18,500 records, about 1,000 encrypted names, undisclosed loss, disclosure on March 17) is well supported by CoinDesk and The Block. The page states the Lazarus attribution slightly more firmly than Bitrefill's own tentative wording. The company-overview figures (900 carriers, 170 countries) are not supported by the cited Coin Bureau page. The entity appears to be operating. No critical omissions found.
   anchoranchored

   chain

   ●mainnet-betaslot 461,982,814

   sig

   2bBg19QjtyMK…1SNYCWbucopyexplorer ↗

   hash

   FKJWkQSSRDxh…aeTVrnV6copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1289 B) ▸

   {"actor":"reviewer","artifact_identity":"1d1a8b2634a905241219ad50d8faa018","decided_at":"2026-10-27T07:17:14.689Z","decision":"review","disputed_pct":0.1,"findings_hash":"CPF8DX3LXiiJ1DZNUFUNs9tPgCAMxyTnNmHXuC9tcfZX","investigation_id":"8038ecc2-39f1-4530-bfdf-f87bf4b49de2","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":52,"omissions":{"material":0,"total":1},"page_content_hash":"881751ee9aba6cbeb746dd44fb93863ee4e63c92e1c609e721e7137edbeb6a07","page_slug":"bitrefill","prev_score":52,"reason":"The incident narrative (date, vector, 18,500 records, about 1,000 encrypted names, undisclosed loss, disclosure on March 17) is well supported by CoinDesk and The Block. The page states the Lazarus attribution slightly more firmly than Bitrefill's own tentative wording. The company-overview figures (900 carriers, 170 countries) are not supported by the cited Coin Bureau page. The entity appears to be operating. No critical omissions found.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":7,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 9fff7695-ece1-45a8-a1ad-b891deca3619copy
8. #8review reviseby judgejudge

   2026-10-27 07:17:15Z
   Score: 52 → 51 (-1)
   The core incident facts (March 1 attack, 18,500 records, about 1,000 encrypted names, March 17 disclosure) are confirmed by CoinDesk and The Block. Counting 1 unverifiable claim out of 10 gives 10%, right on the approve/minor boundary, and the page is placed in the minor band because of two issues: the Lazarus attribution is stated more firmly than Bitrefill's own tentative wording (claim_findings[1], [2]; omission_findings[0], minor), and the company overview figures of 900 carriers and 170 countries are not supported by the cited Coin Bureau page (claim_findings[7]). No shutdown, sanction or material omission was found, so the penalty is kept at the low end.
   anchoranchored

   chain

   ●mainnet-betaslot 461,982,819

   sig

   2WMVtr1yasS3…jMhix8Nfcopyexplorer ↗

   hash

   BR26RUHTA5Bu…KLgrh8eBcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1416 B) ▸

   {"actor":"judge","artifact_identity":"1d1a8b2634a905241219ad50d8faa018","band_override":null,"decided_at":"2026-10-27T07:17:14.689Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.1,"investigation_id":"8038ecc2-39f1-4530-bfdf-f87bf4b49de2","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":51,"page_slug":"bitrefill","prev_score":52,"reason":"The core incident facts (March 1 attack, 18,500 records, about 1,000 encrypted names, March 17 disclosure) are confirmed by CoinDesk and The Block. Counting 1 unverifiable claim out of 10 gives 10%, right on the approve/minor boundary, and the page is placed in the minor band because of two issues: the Lazarus attribution is stated more firmly than Bitrefill's own tentative wording (claim_findings[1], [2]; omission_findings[0], minor), and the company overview figures of 900 carriers and 170 countries are not supported by the cited Coin Bureau page (claim_findings[7]). No shutdown, sanction or material omission was found, so the penalty is kept at the low end.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":-1,"score_limit":{"applied":-1,"limited":true,"proposed":-5,"rule":"limited_no_second_opinion","second":null},"sequence_num":8,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 757a0642-8e2d-4a93-9aec-1da32fc71464copy
9. #9rescoreby systemsystem

   2026-11-01 12:37:21Z
   Score: 51 → 63 (+12)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 51 → 63. Problems weighed by who is responsible: incidents the subject suffered −20, problems around the subject, caused by others −1.6; legitimacy credit long-running +10; the penalty for incidents it suffered is capped at 20; 1 section(s) set aside until a failed fact-check is resolved; fact-check adjustments (−1) now shown as page reliability, not in the score.
   anchoranchored

   chain

   ●mainnet-betaslot 464,095,056

   sig

   G98hGU1CdfTW…eMJDtZWQcopyexplorer ↗

   hash

   2USdBY1TUat8…drLANTPqcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (800 B) ▸

   {"actor":"system","decided_at":"2026-11-01T12:37:21.365Z","decision":"rescore","investigation_id":"8038ecc2-39f1-4530-bfdf-f87bf4b49de2","new_score":63,"page_slug":"bitrefill","prev_score":51,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 51 → 63. Problems weighed by who is responsible: incidents the subject suffered −20, problems around the subject, caused by others −1.6; legitimacy credit long-running +10; the penalty for incidents it suffered is capped at 20; 1 section(s) set aside until a failed fact-check is resolved; fact-check adjustments (−1) now shown as page reliability, not in the score.","score_delta":12,"score_model":"v2","sequence_num":9,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 76110e37-27ff-4ebc-9180-f73c80e24344copy
10. #10rescoreby systemsystem

    2026-11-03 05:56:51Z
    Score: 63 → 78 (+15)
    Re-read and rescored after the page was re-researched (2026-11-03). Rescored under Scoring v2, the published formula (avoid.net/scoring): 63 → 78. Problems weighed by who is responsible: incidents the subject suffered −9.2, concerns that are not fraud −1.2, problems around the subject, caused by others −0.6; legitimacy credit long-running +10, regulated +5.
    anchoranchored

    chain

    ●mainnet-betaslot 464,789,059

    sig

    ADrrraDh3eqj…CMXSPyXRcopyexplorer ↗

    hash

    rYtqNCHa9E5V…WNX9ap1Scopysha256 → base58

    verifying row…full verify ↗

    canonical bytes (724 B) ▸

    {"actor":"system","decided_at":"2026-11-03T05:56:50.264Z","decision":"rescore","investigation_id":"8038ecc2-39f1-4530-bfdf-f87bf4b49de2","new_score":78,"page_slug":"bitrefill","prev_score":63,"reason":"Re-read and rescored after the page was re-researched (2026-11-03). Rescored under Scoring v2, the published formula (avoid.net/scoring): 63 → 78. Problems weighed by who is responsible: incidents the subject suffered −9.2, concerns that are not fraud −1.2, problems around the subject, caused by others −0.6; legitimacy credit long-running +10, regulated +5.","score_delta":15,"score_model":"v2","sequence_num":10,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

    Verify offline (run on your own machine)

    python -m src.verify_decision c62c4200-1471-4a57-a253-2f7c68066abacopy
11. #11reviewby reviewerreviewer

    2026-11-03 05:59:19Z
    Score: 78 → 78 (no score change)
    The core incident claims (dates, 18,500 records, hot wallet drains, tentative Lazarus attribution, responder firms) are supported by Decrypt, The Block and teiss. Company details match Bitrefill's homepage and CoinDesk. No disputed claims were found. Trustpilot figures and the Bitrefill blog founding quote were not checked. The subject is still operating.
    anchoranchored

    chain

    ●mainnet-betaslot 464,789,827

    sig

    5LcU3yGibBet…23nzR7D8copyexplorer ↗

    hash

    5ZhCNNuESeHn…Fpu7Pi9Lcopysha256 → base58

    verifying row…full verify ↗

    canonical bytes (1244 B) ▸

    {"actor":"reviewer","artifact_identity":"635070dbd0159132d3ee801d1bfffd1a","blocked_count":1,"decided_at":"2026-11-03T05:59:19.511Z","decision":"review","disputed_pct":0.0909,"findings_hash":"Hzy3tYGshduriUAXA5u8ewsQyMwPGsHyANpieC9KaeRG","investigation_id":"8038ecc2-39f1-4530-bfdf-f87bf4b49de2","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":78,"omissions":{"material":0,"total":1},"page_content_hash":"6167e06e771638c449dd5f07303e8216470ccf1b6202ad94da252c8bc4174daf","page_slug":"bitrefill","prev_score":78,"reason":"The core incident claims (dates, 18,500 records, hot wallet drains, tentative Lazarus attribution, responder firms) are supported by Decrypt, The Block and teiss. Company details match Bitrefill's homepage and CoinDesk. No disputed claims were found. Trustpilot figures and the Bitrefill blog founding quote were not checked. The subject is still operating.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":11,"sequence_num":11,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

    Verify offline (run on your own machine)

    python -m src.verify_decision 9cc22475-c313-465b-8033-86bebd77af76copy
12. #12review approveby judgejudge

    2026-11-03 05:59:19Z
    Score: 78 → 78 (no score change)
    No claim was disputed. Of 11 claims, 9 were confirmed, 1 was partially supported (claim_findings[4], the KYC data statement, where the core point holds) and 1 could not be checked (claim_findings[6], the Bitrefill blog founding-year quote; the 2014 CoinDesk date was confirmed and the discrepancy is disclosed on the page). One Trustpilot finding (claim_findings[8]) was excluded because the source blocked the reviewer. That leaves about 10% unverified and 0% disputed, which is within the approval band. The core incident claims (dates, 18,500 records, hot wallet drains, tentative Lazarus attribution, responder firms) are backed by Decrypt, The Block and teiss. The only omission found is minor (the downtime after the breach lasted longer than the page implies), and the company is still operating.
    anchoranchored

    chain

    ●mainnet-betaslot 464,789,833

    sig

    56Q8Ce3ibpeK…6QPeYjzFcopyexplorer ↗

    hash

    BJ77CX7DEzxg…MCwuXQ3Acopysha256 → base58

    verifying row…full verify ↗

    canonical bytes (1485 B) ▸

    {"actor":"judge","artifact_identity":"635070dbd0159132d3ee801d1bfffd1a","band_override":null,"blocked_count":1,"decided_at":"2026-11-03T05:59:19.511Z","decision":"review_approve","delist_requested":false,"disputed_pct":0.0909,"investigation_id":"8038ecc2-39f1-4530-bfdf-f87bf4b49de2","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":78,"page_slug":"bitrefill","prev_score":78,"reason":"No claim was disputed. Of 11 claims, 9 were confirmed, 1 was partially supported (claim_findings[4], the KYC data statement, where the core point holds) and 1 could not be checked (claim_findings[6], the Bitrefill blog founding-year quote; the 2014 CoinDesk date was confirmed and the discrepancy is disclosed on the page). One Trustpilot finding (claim_findings[8]) was excluded because the source blocked the reviewer. That leaves about 10% unverified and 0% disputed, which is within the approval band. The core incident claims (dates, 18,500 records, hot wallet drains, tentative Lazarus attribution, responder firms) are backed by Decrypt, The Block and teiss. The only omission found is minor (the downtime after the breach lasted longer than the page implies), and the company is still operating.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":11,"sequence_num":12,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

    Verify offline (run on your own machine)

    python -m src.verify_decision 184b4c60-93c0-4ac5-8e30-5b13335f3595copy
13. #13rescoreby systemsystem

    2026-11-03 05:59:20Z
    Score: 78 → 79 (+1)
    Recalculated after the fact-check of 2026-11-03. Rescored under Scoring v2, the published formula (avoid.net/scoring): 78 → 79. Problems weighed by who is responsible: incidents the subject suffered −9.2, problems around the subject, caused by others −0.6; legitimacy credit long-running +10, regulated +5; 1 section(s) set aside until a failed fact-check is resolved.
    anchoranchored

    chain

    ●mainnet-betaslot 464,789,838

    sig

    3q35bujeHaQA…qMBrEZ1wcopyexplorer ↗

    hash

    EscNg6gjAKhW…RsVqWLFkcopysha256 → base58

    verifying row…full verify ↗

    canonical bytes (732 B) ▸

    {"actor":"system","decided_at":"2026-11-03T05:59:19.511Z","decision":"rescore","investigation_id":"8038ecc2-39f1-4530-bfdf-f87bf4b49de2","new_score":79,"page_slug":"bitrefill","prev_score":78,"reason":"Recalculated after the fact-check of 2026-11-03. Rescored under Scoring v2, the published formula (avoid.net/scoring): 78 → 79. Problems weighed by who is responsible: incidents the subject suffered −9.2, problems around the subject, caused by others −0.6; legitimacy credit long-running +10, regulated +5; 1 section(s) set aside until a failed fact-check is resolved.","score_delta":1,"score_model":"v2","sequence_num":13,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

    Verify offline (run on your own machine)

    python -m src.verify_decision 13cf0332-3798-4e9b-8f9e-e60805cc5c81copy