← Bitrefillreviewed 2026-11-03 · 12 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Bitrefill against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #7[unverifiable][awaiting moderator]in section: Company Overview
“Founded in 2015, by Sergej Kotliar and co-founders Michael Grünberger and Michel Gustavsson,”
reviewerFounded in 2015 per Bitrefill blog; 2014 per CoinDesk.CoinDesk's 2014 confirmed; I did not fetch the Bitrefill blog quote. - #10[unverifiable][awaiting moderator]in section: Customer Complaints
“Bitrefill holds a Trustpilot rating described by the platform as 4.5 out of 5 across roughly 2,700-3,000 reviews”
reviewerTrustpilot rating 4.5/5 across roughly 2,700-3,000 reviews.Trustpilot not fetched; figures are volatile and the page already labels the section low-confidence.
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #5[partially supported][awaiting moderator]in section: March 2026 Cyberattack and Data Exposure
“KYC verification data, where required, is held only by an external provider and was not affected.”
reviewerKYC data held only by an external provider and not affected.Core point holds; 'was not affected' not directly verified in fetched text.
confirmed
9 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: March 2026 Cyberattack and Data Exposure
“Bitrefill disclosed on March 17, 2026 that it had been the target of a cyberattack that began on March 1, 2026.”
reviewerBitrefill disclosed on March 17, 2026 a cyberattack that began March 1, 2026, via a compromised employee laptop.Both sources agree. - #2[confirmed][no action needed]in section: March 2026 Cyberattack and Data Exposure
“Bitrefill stated that approximately 18,500 purchase records were affected, exposing fields such as email addresses, cryptocurrency payment addresses, and IP-address metadata.”
reviewerAbout 18,500 purchase records affected; ~1,000 with encrypted names potentially exposed; those users contacted.Figures consistent across sources. - #3[confirmed][no action needed]in section: March 2026 Cyberattack and Data Exposure
“Reporting from The Block and Decrypt indicates attackers drained funds from some hot wallets and made suspicious purchases through vendor accounts”
reviewerHot wallets drained and suspicious vendor purchases made; no total loss disclosed; losses covered from operating capital.Attribution wording is hedged ('Reporting ... indicates') and fits. - #4[confirmed][no action needed]in section: March 2026 Cyberattack and Data Exposure
“worked with outside incident-response firms (reported as zeroShadow, SEAL911 and RecoverisTeam) and law enforcement, and that payments, stock and accounts had returned to normal by the time of disclosure.”
reviewerResponse firms were zeroShadow, SEAL911 and RecoverisTeam, and law enforcement; services returned to normal by disclosure.Supported by teiss. 'Returned to normal' slightly stronger than teiss's 'returning to normal levels' for volumes. - #6[confirmed][no action needed]in section: Lazarus Group Attribution
“Bitrefill's attribution of the attack to North Korean state-linked hacking groups is tentative rather than confirmed.”
reviewerAttribution to Lazarus/BlueNoroff is tentative; Bitrefill cited similarities.Matches. The page's negative claim that no agency or forensics firm has confirmed was not exhaustively checked. - #8[confirmed][no action needed]in section: Company Overview
“The service is operated by Airfill Prepaid AB, registered in Stockholm, Sweden, according to Bitrefill's website footer.”
reviewerOperated by Airfill Prepaid AB in Stockholm; homepage advertises 8k+ products in 180+ countries.Confirmed.citedwww.bitrefill.com/ - #9[confirmed][no action needed]in section: Company Overview
“An earlier CoinDesk profile, describing the service as of 2019, cited availability in 170 countries and more than 1,650 partner businesses;”
reviewerCoinDesk 2019 profile cites 170 countries and 1,650+ partner businesses.Confirmed. - #11[confirmed][no action needed]in the timeline
“Bitrefill founded by Sergej Kotliar (CoinDesk and other third-party sources give 2014; Bitrefill's own blog gives 2015).”
reviewerTimeline: founded 2014 by Kotliar.Confirmed with disclosed discrepancy. - #12[confirmed][no action needed]in the timeline
“Bitrefill publicly discloses the breach, stating about 18,500 purchase records were affected and tentatively attributing the attack to North Korea's Lazarus/BlueNoroff groups.”
reviewerTimeline: breach disclosed 2026-03-17.Confirmed.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.