Bitrefill links Lazarus Group to employee laptop hack, stolen funds

Crypto e-commerce store Bitrefill has revealed it was the unfortunate of a cybersecurity onslaught connected March 1, with the methods utilized intimately resembling those of Lazarus Group, North Korea’s notorious hacking organization.

In a station to X connected Tuesday, Bitrefill said the hackers utilized malware, on-chain tracing, and reused IP and email infrastructure to compromise an employee’s laptop, enabling them to drain funds from the company’s blistery wallets portion besides accessing 18,500 acquisition records, perchance revealing “limited lawsuit information.”

Bitrefill said BlueNoroff Group, different North Korean hacking enactment with adjacent ties to the Lazarus Group, whitethorn person besides been progressive oregon been the sole attacker.

Source: Bitrefill

Bitrefill, which enables customers to walk crypto connected real-world products and acquisition cards, said determination was nary grounds that the hackers extracted its database, suggesting the motive was financial.

“There is nary grounds that they extracted our full database, lone that the attackers ran a constricted fig of queries accordant with probing to recognize what determination was to steal, including cryptocurrency and Bitrefill acquisition paper inventory.”

While Bitrefill didn’t disclose however overmuch funds were stolen, the institution said it “will absorb” those losses from its operational capital.

"Almost everything is backmost to normal: payments, stock, accounts," Bitrefill said, adding: “Sales volumes are besides backmost to normal, and we are eternally thankful to our customers for your continued assurance successful us."

Despite galore crypto platforms strengthening information measures successful caller years, blase hackers person continued to find ways to breach their defenses.

Related: Bonk.fun warns hackers hijacked domain successful wallet-drainer attack

Lazarus Group remains the crypto industry’s astir formidable menace and was down the largest hack successful crypto history, erstwhile it stole $1.4 billion from crypto speech Bybit successful February 2025.

Bitrefill has upped its information measures

Bitrefill said it contacted instrumentality enforcement and worked with crypto information firms Security Alliance, FearsOff Security, Recoveris.io and zeroShadow to navigate the cybersecurity incident. Part of its archetypal effect was to crook its systems offline to incorporate the attack.

Bitrefill said it has already “significantly improved” its cybersecurity practices since the incident. 

Those measures see cybersecurity reviews with information researchers and implementing their recommendations, tightening interior entree controls and improving monitoring strategies for faster detection and response.

Magazine: China’s ‘50x’ blockchain boost, Alibaba-linked AI mines Bitcoin: Asia Express