Bitrefill blames North Korean Lazarus group for cyberattack

Bitrefill suffered a sophisticated intrusion likely conducted by the North Korean Lazarus/Bluenoroff cluster: attackers compromised an employee laptop, reused legacy credentials to access production secrets and parts of the infrastructure, drained some cryptocurrency wallets and exploited gift card inventory. The breach exposed approximately 18,500 purchase records (emails, IPs, crypto payment addresses) and 1,000 customer names (potentially decryptable), but Bitrefill reports minimal financial loss covered from capital and is restoring services while tightening security.