Bitrefill Targeted by North Korean Lazarus Hackers, 18,500 Purchase Records Leaked, Operations Restored

Gate News: On March 18, the crypto payment and gift card platform Bitrefill announced that part of its infrastructure and cryptocurrency wallets were attacked by Lazarus, a hacking group linked to North Korea. Approximately 18,500 purchase records were leaked. These records include email addresses, payment addresses, and IP information, with about 1,000 records involving crypto usernames. Affected users have been notified. The company stated it will use operational funds to cover the losses, and operations have fully resumed.

The attack began when an employee’s laptop was compromised, leading to the leak of old credentials. The attackers gained access to Bitrefill’s database and hot wallets and attempted to drain some funds. The platform promptly took systems offline to control the damage. Bitrefill indicated that customer data was not the main target; the attack primarily focused on cryptocurrency holdings and gift card inventory, rather than stealing the entire database.

Lazarus Group has previously attacked projects such as Ronin Network, Harmony’s Horizon Bridge, WazirX, and Atomic Wallet. The methods used in this attack include malware, on-chain tracking, and reused IP and email addresses, closely resembling Lazarus’s past operations.

Bitrefill has implemented multiple security measures, including external penetration testing, enhanced internal access controls, improved log monitoring, and refined incident response procedures and automatic shutdown protocols. The company stated this was its first major attack in over ten years, but it has sufficient funds and strong profitability to withstand losses. Payment, inventory, and account systems have been restored to normal, and sales have returned to stable levels.

The company reminds customers to stay vigilant, watch for suspicious communications related to Bitrefill or cryptocurrencies, and commits to continuously improving security to protect user assets and privacy. (CoinDesk)