Bitcoin payment service provider Bitrefill announced on the X platform that it experienced a cyberattack on March 1, 2026, leading to a customer data breach. According to Odaily, the attack originated from a compromised employee laptop, allowing attackers to access parts of the database and cryptocurrency wallets. The investigation revealed that the attack methods closely resemble those used by the North Korean DPRK Lazarus/Bluenoroff hacking group in previous attacks on crypto companies. Approximately 18,500 purchase records involving limited customer information, such as email addresses, crypto payment addresses, and IP metadata, were affected