Disclosed cyberattack; about 18,500 purchase records accessed and hot wallets drained
Bitrefill disclosed on 17 March 2026 that an intrusion beginning on 1 March, traced to a compromised employee laptop, gave attackers access to production systems and hot wallets. According to press coverage of its report, roughly 18,500 purchase records were accessed, including email addresses, payment addresses and IP addresses, with about 1,000 containing encrypted names. The company said it would cover all losses from operating capital and suggested a state-linked group was likely responsible.
This entry summarises a public report and links to it. It is a record of what was reported, not a finding of wrongdoing. If you represent Bitrefill, you can
claim the listing and respond here. To correct an error, send a correction.
