Wu Blockchain has learned that cryptocurrency payment platform Bitrefill disclosed that it suffered a cyberattack on March 1, 2026. The attack is suspected to be related to the North Korean Lazarus/Bluenoroff group, stemming from compromised employee devices and leaked credentials. Using these credentials, attackers accessed certain databases and hot wallets and transferred funds. Approximately 18,500 order records were accessed, involving information such as email addresses and cryptocurrency addresses, with some records containing names that face potential exposure risks. The company stated that it does not store complete KYC data, business operations have largely recovered, and related losses will be borne by the company itself.