Bitrefill details March 1, 2026 breach after hot wallets drained and 18,500 records accessed

Bitrefill said a cyberattack on March 1, 2026 led to unauthorized hot-wallet transfers and disruption to parts of its internal infrastructure. The company reported that database logs indicate roughly 18,500 purchase records were accessed, with about 1,000 including encrypted customer names that it is treating as potentially exposed. Bitrefill said its investigation found operational similarities to activity linked to the Lazarus Group, but it did not make a definitive attribution.