Wu Shuo has learned that cryptocurrency payment platform Bitrefill disclosed that it experienced a cyber attack on March 1, 2026. The attack is suspected to be related to the North Korean Lazarus/Bluenoroff group, stemming from compromised employee devices and leaked credentials. Attackers used this access to reach certain databases and hot wallets, transferring funds. Approximately 18,500 order records were accessed, involving information such as emails and cryptocurrency addresses, with some records containing names that face potential exposure risks. The company stated that it does not store complete KYC data, operations have largely recovered, and related losses will be borne by the company itself.