{ "id": 63710, "date": "2026-03-18T10:20:34", "date_gmt": "2026-03-18T03:20:34", "guid": { "rendered": "https:\/\/hbbgroup.net\/bitrefill-links-lazarus-group-to-employee-laptop-hack-stolen-funds\/" }, "modified": "2026-03-18T10:20:34", "modified_gmt": "2026-03-18T03:20:34", "slug": "bitrefill-links-lazarus-group-to-employee-laptop-hack-stolen-funds", "status": "publish", "type": "post", "link": "https:\/\/hbbgroup.net\/en_us\/bitrefill-links-lazarus-group-to-employee-laptop-hack-stolen-funds\/", "title": { "rendered": "Bitrefill links Lazarus Group to employee laptop hack, stolen funds" }, "content": { "rendered": "
\n

Crypto e-commerce store Bitrefill has revealed it was the victim of a cybersecurity attack on March 1, with the methods used closely resembling those of Lazarus Group, North Korea\u2019s notorious hacking organization.<\/p>\n

In a post to X on Tuesday, Bitrefill said<\/a> the hackers used malware, on-chain tracing, and reused IP and email infrastructure to compromise an employee\u2019s laptop, enabling them to drain funds from the company\u2019s hot wallets while also accessing 18,500 purchase records, potentially revealing \u201climited customer information.\u201d<\/p>\n

Bitrefill said BlueNoroff Group, another North Korean hacking organization with close ties to the Lazarus Group,<\/a> may have also been involved or been the sole attacker.<\/p>\n


<\/strong>Source: <\/em>Bitrefill<\/em><\/a><\/figcaption><\/figure>\n

Bitrefill, which enables customers to spend crypto on real-world products and gift cards, said there was no evidence that the hackers extracted its database, suggesting the motive was financial.<\/p>\n

\u201cThere is no evidence that they extracted our entire database, only that the attackers ran a limited number of queries consistent with probing to understand what there was to steal, including cryptocurrency and Bitrefill gift card inventory.\u201d<\/p><\/blockquote>\n

While Bitrefill didn\u2019t disclose how much funds were stolen, the company said it \u201cwill absorb\u201d those losses from its operational capital.<\/p>\n

“Almost everything is back to normal: payments, stock, accounts,” Bitrefill said, adding: \u201cSales volumes are also back to normal, and we are eternally thankful to our customers for your continued confidence in us.”<\/p>\n