Lazarus Group Bitrefill Cyberattack Crypto Threat

Bitrefill disclosed a March 1, 2026 intrusion attributed to the Lazarus Group (North Korea) in which attackers gained access via a compromised employee laptop and a legacy credential, escalated privileges, probed for high-value crypto assets, drained hot wallets, and accessed ~18,500 purchase records; the report outlines attacker TTPs, attribution indicators, and Bitrefill's remediation steps.