Loading story…
Bitrefill said attackers linked to North Korea's Lazarus Group breached the cryptocurrency gift card platform on March 1 by first compromising an employee laptop, stealing a legacy credential, and using it to access a snapshot containing production secrets. The intrusion expanded into broader infrastructure, including parts of the database, production keys, and cryptocurrency wallets, and was detected after the company observed suspicious purchasing patterns indicating abuse of its gift card inventory and supplier channels.
The company said the attackers drained funds from some hot wallets and accessed about 18,500 purchase records containing email addresses, crypto payment addresses, IP addresses, and related metadata; roughly 1,000 records also included encrypted usernames. Bitrefill attributed the incident using a combination of malware analysis, TTPs, IP and email overlaps, and blockchain tracing, notified affected users, restored operations after taking systems offline, and said it would absorb losses from operational capital, though it did not disclose the total amount stolen.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
Following disclosure, Bitrefill said it notified affected users, would absorb losses through operational capital, and began working with incident responders, security researchers, on-chain analysts, and law enforcement while strengthening access controls, monitoring, and testing.
Bitrefill publicly announced the March 1 breach on social media on Tuesday, saying the incident exposed roughly 18,500 purchase records and attributing the attack to North Korea-linked Lazarus Group based on malware, infrastructure, email addresses, and blockchain tracing.
Bitrefill said it restored its website and app on 2026-03-05 after containment and recovery efforts. The company continued gradually resuming services while investigating the breach.
After detecting unusual supplier purchasing patterns and hot-wallet draining activity during the intrusion, Bitrefill took systems offline to contain the incident. The attack exposed about 18,500 purchase records and involved abuse of gift card inventory and supply lines.
On 2026-03-01, attackers gained initial access to Bitrefill through a compromised employee laptop, used a legacy credential to reach production secrets, and expanded into parts of the company's infrastructure, database, and some cryptocurrency wallets.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebleepingcomputer.com
Open sourcenknews.org
Open sourcetherecord.media
Open sourcecoindesk.com
Open sourceteiss.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean state-sponsored threat actors, including the Lazarus Group and Kimsuky, have been responsible for a dramatic surge in global cryptocurrency theft in 2025, stealing at least $2.02 billion—over half of the total $3.4 billion stolen worldwide. The February compromise of the Bybit cryptocurrency exchange accounted for $1.5 billion of these losses, with the attack attributed to the TraderTraitor cluster, and further links established through malware infrastructure analysis. Lazarus Group, affiliated with North Korea's Reconnaissance General Bureau, has also been implicated in the theft of $36 million from Upbit and is estimated to have stolen over $6.75 billion cumulatively through a series of high-profile heists and campaigns. Recent collaborative research by Hunt.io and the Acronis Threat Research Unit has uncovered new operational infrastructure used by both Lazarus and Kimsuky across global campaigns. The investigation revealed active tool-staging servers, credential theft environments, and tunneling nodes, highlighting the interconnected nature of DPRK cyber operations. Despite evolving malware and tactics, these groups consistently reuse infrastructure, making their activities traceable across campaigns. The findings provide defenders with actionable intelligence on the infrastructure patterns and operational habits of North Korean threat actors, supporting efforts to detect and disrupt ongoing and future attacks.
Jun 29, 2026
Security researchers reported new infrastructure and host-level artifacts tying **Lazarus Group** activity to the **$1.4 billion ByBit theft**, including the domain `bybit-assessment[.]com` and a compromised machine allegedly used by a senior North Korean operator. Hudson Rock said a **LummaC2** infostealer log exposed the system, while Silent Push separately linked the email address `trevorgreer9312@gmail.com` to registration activity for the ByBit-themed domain shortly before the attack, strengthening attribution to DPRK-linked operations. The exposed host reportedly contained malware-development and evasion tools, cryptocurrency-related activity, and infrastructure associated with phishing, exfiltration, and command-and-control operations. Researchers also identified operational artifacts including **Astrill VPN**, browser evidence suggesting Korean-language activity with Chinese-Simplified settings, and use of **Dropbox, Slack, Telegram**, **Namecheap** domains, and spoofed **Zoom-themed** subdomains, describing the machine as an unusual forensic view into shared Lazarus tradecraft and support infrastructure used across multiple campaigns.
Aug 20, 2026
Crypto exchange **Bybit** lost about **$1.5 billion** in Ethereum-linked assets after attackers compromised the platform in what has been described as the largest cryptocurrency theft on record. Blockchain investigators at TRM Labs and a subsequent **FBI/IC3** public attribution linked the operation to North Korean threat actors, citing wallet overlaps and tradecraft consistent with earlier DPRK-backed campaigns. Reporting tied the theft to a broader pattern of financially motivated North Korean operations that have previously targeted major crypto platforms and financial institutions. After the theft, the stolen funds were moved at high speed through intermediary wallets, decentralized exchanges, and cross-chain bridges, with a large share ultimately converted into **Bitcoin**. Analysts said the laundering operation showed an evolution in DPRK tactics away from reliance on traditional mixers and toward rapid, high-volume cross-chain obfuscation; later reporting said more than **$1 billion** had been laundered within months. The heist also triggered recovery efforts, including Bybit's **10% bounty** program for frozen or recovered assets, and intensified debate over cryptocurrency oversight and the implications for future U.S. regulation.
Jun 29, 2026