Lazarus Group Suspected in Major Bitrefill Cyberattack Incident
Cyberattack on Bitrefill Linked to Notorious Lazarus Group
A recent cyberattack on cryptocurrency platform Bitrefill has been linked to the notorious Lazarus Group, a state-sponsored hacking collective based in North Korea.
Breach Details
The breach, which occurred in early March, resulted in the exposure of approximately 18,500 customer records and the theft of funds from hot wallets.
The company noted that indicators such as attack methodology, malware used, and IP addresses pointed to the involvement of the Lazarus/Bluenoroff subgroup, which has been known to target the cryptocurrency industry.
Attack Impact
During the incident, hackers drained funds from several of Bitrefill’s wallets and executed suspicious transactions with the company’s vendors. The total financial impact of the attack is currently unclear.
The breach also compromised parts of the company’s database and certain cryptocurrency wallets, with around 1,000 records containing encrypted customer names deemed to be at higher risk. Affected individuals were notified by the company.
Lazarus Group’s Threat to Cryptocurrency Sector
The Lazarus Group has been identified as one of the most significant threats to the cryptocurrency sector. In 2025, North Korea-linked groups and individuals were estimated to have stolen approximately $2.02 billion in cryptocurrency, including a $1.5 billion hack of the Bybit exchange attributed to Lazarus.
Bitrefill’s Response
Bitrefill has stated that customer data was not the primary target of the attack, as most purchases on the platform do not require mandatory know-your-customer (KYC) checks. Where KYC is necessary, the information is stored exclusively with external KYC providers.
The company has absorbed the losses from its operational capital and worked closely with cybersecurity firms to respond to the incident.
Expert Insights
Experts have highlighted the breach as a warning to the cryptocurrency industry, emphasizing the importance of robust security protocols and continuous monitoring to protect customer data.
The incident also underscores the need for companies to prioritize employee training, internal oversight, and regular system audits to mitigate potential risks.
About Author
English