Bitrefill said a March 1, 2026 cyberattack linked to North Korea’s Lazarus Group compromised parts of its infrastructure, drained some hot wallets, and exposed about 18,500 purchase records. The company said the breach began with a compromised employee laptop that revealed legacy credentials, allowing attackers to access production keys, exploit gift card supply chains, and move funds before systems were taken offline. Bitrefill said about 1,000 records included encrypted usernames or names for specific products, affected users were notified, and the company will cover losses from operational capital while working with security researchers, incident response teams, on-chain analysts, and law enforcement.