Bitrefill says Lazarus-linked hackers breached systems, stole funds

Crypto e-commerce store Bitrefill revealed it was the victim of a cybersecurity attack on March 1, saying the methods closely resembled those used by North Korea’s Lazarus Group. The company said hackers employed malware, on-chain tracing and reused IP and email infrastructure to compromise an employee’s laptop, allowing them to drain funds from the company’s hot wallets and access 18,500 purchase records that may contain limited customer information.

Bitrefill suggested BlueNoroff, another North Korean group with close ties to Lazarus, may have been involved or the sole attacker. It added there was no evidence the attackers extracted the entire database, only that they ran a limited number of queries consistent with probing to identify assets such as cryptocurrency and gift card inventory.

The company did not disclose how much was taken and said it will absorb the losses from operational capital.

North Korea

bitrefill, lazarus group, bluenoroff, north korea, hot wallets, malware, on-chain tracing, stolen funds, purchase records, gift cards