Bitrefill cyberattack forces platform shutdown and disrupts gift-card supply systems

On 1 March 2026, attackers compromised an employee laptop and used a legacy production credential to reach Bitrefill infrastructure, including parts of its database, cryptocurrency wallets and gift-card purchasing systems. Bitrefill detected suspicious supplier purchasing, drained hot wallets and exploitation of gift-card inventory, then took systems offline; its website and app were restored on 5 March. About 18,500 purchase records were accessed. Bitrefill said the malware, infrastructure and on-chain indicators showed strong similarities to prior Lazarus/BlueNoroff activity, but the attribution was presented as an assessment rather than definitive proof.