Skip to content
NoKYC Score
DirectoryExchangesSwapsBuyRatesIncidentsGuides List a project Sign in

Gift Cards Since 2014 Reviewed 22 Oct 2026

Bitrefill review

Largest crypto gift-card, top-up and eSIM store; terms allow KYC requests

  • Accepts Lightning
  • No email needed
  • Company named
  • 5+ years operating
  • May ask for ID
  • Screens deposits
ID on risk flag KYC 3 Documentation reviewed
Visit bitrefill.com Report an incident Watch

Privacy

2.1/ 10

Poor

Safety

5.0/ 10

Caution

Based on terms and documentation. No test transactions published yet. See the arithmetic

Bitrefill review in short

Bitrefill is a gift card store operating since 2014. Its terms put it at KYC level 3 of 4: ID on risk flag. NoKYC Score grades it 2.1/10 for privacy (poor) and 5.0/10 for safety (caution). In its favour: no email needed, accepts Lightning and company named. To watch: it may ask for ID and screens deposits. One incident is on record, the latest from 1 Mar 2026.

Category
Gift Cards
KYC level
3 of 4: ID on risk flag
Grades
Privacy 2.1/10, Safety 5.0/10
Sign-up
Email optional
Custody
mixed
Jurisdiction
Sweden
Incidents on record
1
Last reviewed
22 Oct 2026
Cite this review

NoKYC Score, "Bitrefill review", reviewed 22 Oct 2026, https://nokycscore.com/service/bitrefill

Also available as plain text.

What Bitrefill is

Bitrefill sells gift cards, mobile top-ups, eSIMs and bill payments for cryptocurrency, including Lightning payments. Its terms, updated on 30 September 2026, name Airfill Prepaid AB, a Swedish company, as the counterparty for gift cards and top-ups. The terms state that suspicious transactions are reported, that a customer may be required at any time to complete a KYC programme, and that exceeding certain thresholds freezes an account until it is verified. In March 2026 the company disclosed a cyberattack in which about 18,500 purchase records were accessed, and said it would cover losses from its own capital.

What Bitrefill offers, and what to watch

4 of 13 privacy and safety features, 2 warnings in its terms.

"Not stated" means its own pages do not say.

Identity

  • ID never required No
  • No account needed Not stated
  • No email needed Yes An email address is not required to sign up or use it.
  • No phone number Not stated

Payment

  • Accepts Monero Not stated
  • Accepts Lightning Yes Bitcoin Lightning payments: fast, cheap and more private than on-chain.
  • Accepts cash Not stated

Access

  • Tor onion address Not stated
  • Works without JavaScript Not stated

Trust

  • Never holds your funds Not stated
  • Independent audit Not stated
  • Company named Yes The operating company and its jurisdiction are published.
  • 5+ years operating Yes Has operated continuously for five years or more.

Warnings

  • May ask for ID Yes The terms reserve the right to demand identity documents, often after a risk flag.
  • Screens deposits Yes Deposits are scored by blockchain analytics; a flag can freeze them.
  • Holds your funds Not in terms
  • Email required Not in terms
  • Phone number required Not in terms
  • Nobody accountable Not in terms

Does Bitrefill require KYC?

  1. 0
  2. 1
  3. 2
  4. 3
  5. 4

KYC level 3: ID on risk flag. The terms allow funds to be held and identity demanded after an automated risk flag.

Terms state a customer "may be required at any time to complete a KYC program" and that exceeding thresholds freezes the account until verified.

Read the terms we assessed ↗

How the grades add up

Both grades start at 50 points and move by fixed, published amounts. Nothing is adjusted by hand. The total is divided by ten.

Privacy

2.1
  • Starting points 50
  • KYC level 3: ID on risk flag -14
  • Accepts Lightning +1
  • AML screening -7
  • May request ID -7
  • Closed source -2
  • Total, clamped to 0–100 21

Safety

5.0
  • Starting points 50
  • Legal entity disclosed +5
  • AML screening -3
  • May request ID -4
  • Closed source -3
  • 5+ years operating +10
  • Disclosed cyberattack; about 18,500 purchase records accessed and hot wallets drained high · resolved paid · 236 days ago -5
  • Total, clamped to 0–100 50

Test ledger

Real transactions run by our editors. A badge without a ledger is an assertion; this is the proof.

No test transactions published yet

The grades above rest on Bitrefill’s terms and documentation. Tests will appear here with the date, route, amount band and result as they are run.

Incidents on record

high

Hack or exploit

Disclosed cyberattack; about 18,500 purchase records accessed and hot wallets drained

Bitrefill disclosed on 17 March 2026 that an intrusion beginning on 1 March, traced to a compromised employee laptop, gave attackers access to production systems and hot wallets. According to press coverage of its report, roughly 18,500 purchase records were accessed, including email addresses, payment addresses and IP addresses, with about 1,000 containing encrypted names. The company said it would cover all losses from operating capital and suggested a state-linked group was likely responsible.

Resolved, user paid out Source: theblock.co ↗

User reviews

Reviews never change a grade. Reviews with a transaction reference are marked.

No reviews yet.

Write a review

Create an account to write a review. It takes ten seconds and needs no email: you get a random key and a random name. Already have a key? Sign in.

Alternatives to Bitrefill

All alternatives →

Cryptorefills

Dutch store for gift cards, top-ups, eSIMs and travel paid in crypto, marketed as no-KYC

Privacy 6.1
Safety 7.1
Not mentioned KYC 1 Docs reviewed

Coincards

Canadian gift-card store accepting Bitcoin and Lightning since 2014

Privacy 5.9
Safety 6.5
Not mentioned KYC 1 Docs reviewed

Coinsbee

Gift cards for 250+ cryptocurrencies; ID check required above €1,000 per order

Privacy 2.3
Safety 5.8
On risk flag KYC 3 Docs reviewed

ProxyStore Digital Goods

Voucher codes for privacy services, paid with Monero, Bitcoin, cash or SEPA

Privacy 8.2
Safety 5.5
Not mentioned KYC 1 Docs reviewed

Bitrefill vs CryptorefillsBitrefill vs CoincardsBitrefill vs CoinsbeeBitrefill vs ProxyStore Digital Goods

Bitrefill: common questions

Does Bitrefill require KYC?

Bitrefill is rated KYC level 3 of 4 on this site: ID on risk flag. Terms state a customer "may be required at any time to complete a KYC program" and that exceeding thresholds freezes the account until verified.

Is Bitrefill safe to use?

Bitrefill has a Safety grade of 5.0 out of 10 and a Privacy grade of 2.1 out of 10. There is 1 incident on record, listed with sources on this page. Evidence level: documentation reviewed.

Is Bitrefill legit?

Bitrefill is a working gift card store that has operated since 2014. It publishes the company that runs it, in Sweden. Being real is not the same as being safe: its Safety grade here is 5.0 out of 10, built from custody, liquidity, track record and incidents.

Is Bitrefill a scam?

NoKYC Score does not label services as scams; it records documented incidents with their sources and outcomes. Bitrefill has 1 incident on record, all resolved, the latest: "Disclosed cyberattack; about 18,500 purchase records accessed and hot wallets drained". Each is listed on this page with its source. Its terms also allow it to hold a flagged deposit and ask for identity documents.

Do I need an account or email to use Bitrefill?

Email optional.

Does Bitrefill have a Tor onion address?

No official onion address was found on Bitrefill's own pages.

Which cryptocurrencies does Bitrefill support?

Bitrefill supports BTC, ETH, USDT, USDC, LTC, and fiat payments in EUR, USD.

Can I use Bitrefill over Tor?

Bitrefill does not publish an official onion address.

Listing history

  • Listing added. Facts and KYC level set from the service's own terms and documentation.
  • Incident recorded: Disclosed cyberattack; about 18,500 purchase records accessed and hot wallets drained