Crypto
Bitrefill blames North Korea-linked Lazarus hacker group for compromising 18,500 purchase records
Cryptocurrency payments and gift card platform Bitrefill has blamed the North Korea-linked hacking group Lazarus for a cyberattack on March 1, 2026, that compromised parts of its infrastructure and cryptocurrency wallets.
The attackers gained access to production keys, transferred funds from hot wallets, and exposed 18,500 purchase records containing emails, payment addresses, and IP addresses.
Approximately 1,000 records included encrypted usernames. Affected users were notified. Operations have resumed, with the company announcing to cover losses from operational capital. The incident underscores the importance of vigilance regarding crypto and on-chain security.
The modus operandi included malware, on-chain tracing and reused IP and email addresses and was similar to previous attacks attributed to North Korea’s Lazarus Group, also known as Bluenoroff, the company said in a detailed report on X.
The Lazarus Group has previously targeted crypto projects including Ronin Network, Harmony’s Horizon Bridge, WazirX, and Atomic Wallet.
How the attack unfolded
It all began with with a compromised employee laptop, which exposed legacy credentials and allowed attackers to access Bitrefill’s broader infrastructure, including parts of its database and cryptocurrency wallets.
The breach quickly became apparent when the company noticed unusual purchasing patterns among certain suppliers, signaling that attackers were exploiting its gift card inventory and supply chains. The firm also noted that attackers were draining some hot wallets and moving funds to their own addresses, following which, the system was taken offline to contain the damage.
“Bitrefill operates a global e-commerce business with dozens of suppliers, thousands of products, and multiple payment methods across many countries. Safely switching all these things off and bringing them back online is not trivial,” the company said in a statement.
Since the incident, Bitrefill has been working with security researchers, incident response teams, on-chain analysts, and law enforcement to investigate the breach.
Customer data impact
Hackers accessed a small set of purchase records, approximately 18,500, containing
Bitrefill said there is no evidence that customer data was a primary target. Its logs indicate that attackers ran a limited number of queries aimed at cryptocurrency holdings and gift card inventory rather than extracting the entire database.
The platform stores minimal personal data and does not require mandatory KYC. A small subset of purchase records, approximately 18,500, was accessed, containing information such as email addresses, crypto payment addresses, and metadata including IP addresses. About 1,000 records contained encrypted names for specific products; the company is treating this data as potentially compromised and has notified affected customers directly by email.
At present, Bitrefill does not believe customers need to take any additional action, though it advises caution regarding unexpected communications related to Bitrefill or cryptocurrency.
Steps to strengthen security
In response to the breach, Bitrefill said it has already strengthened its cybersecurity practices and is working to draw lessons from the incident.
The company outlined several measures, including conducting comprehensive penetration tests with external experts, tightening internal access controls, enhancing logging and monitoring for faster threat detection, and refining incident response procedures and automated shutdown protocols.
Looking forward
Bitrefill acknowledged that this was its first major attack in more than a decade of operation but stressed that it remains well-funded and profitable, capable of absorbing operational losses. Most systems, including payments, stock, and accounts, are back online, with sales volumes returning to normal.
“Getting hit by a sophisticated attack sucks (a lot),” the company said. “But we survived. We will continue to do our best to continue deserving our customers’ trust.”
Crypto
Stablecoin Settlement Is Here, but Seamless Off-Chain Money Movement Is Not | PYMNTS.com
The stablecoin industry has spent years trying to prove one thing above all else: that blockchain-based money can move faster, cheaper and more efficiently than the financial infrastructure it hopes to replace.
Crypto
Certik Unveils ‘Anti-Virus for AI Agents’ as Skill Marketplaces Face Hidden Threats
Key Takeaways
- Certik launched a security platform to provide an “anti-virus” layer for agent ecosystems.
- Sector audits reveal high risks, but CertiK aims to protect marketplaces with 90.5% scanning precision.
- Finchip.ai is among platforms expanding integrations ahead of future consumer-facing scan updates.
The Security Challenge
Blockchain and AI security firm Certik, on May 27, unveiled a new security platform designed to evaluate risks in third-party artificial intelligence (AI) skills. Dubbed the “anti-virus for AI agents,” the release comes amid growing industry concern over the security of AI skill marketplaces.
Security researchers have warned that many of these skills are unvetted, can execute system-level actions and may contain hidden malicious behavior, creating a new software supply chain risk for the AI era. Security audits across the sector have identified risks ranging from credential harvesting and data exfiltration to fund-transfer manipulation and prompt-based override attacks.
Despite these concerns, AI skill marketplaces have expanded rapidly as agent ecosystems mature. However, unlike traditional app stores, most skills are sourced from public repositories with little or no review. Analysts say this creates opportunities for attackers to embed harmful instructions, trigger unauthorized data access or manipulate autonomous execution flows.
In a recent blog post, Certik said its skill scanner platform is designed specifically to evaluate risks that emerge during execution, including scenarios involving financial transactions or fund calls. The scanner produces a numerical score from 0 to 100, along with “pass,” “warn” or “fail” verdicts and categorized findings. According to the company, the system achieves up to 90.5% precision in identifying security risks.
“As AI agents become more deeply integrated into financial systems, enterprise workflows and everyday digital interactions, the security model around third-party skills becomes critically important,” said Ronghui Gu, Certik’s CEO and co-founder. “CertiK Skill Scanner was built to establish a standardized trust layer before execution, helping users and platforms identify hidden risks before sensitive data, assets or systems are exposed.”
Certik said AI skill marketplaces can integrate the scanner directly into publishing pipelines, automatically reviewing skills before they go live and displaying security verdicts to users. Enterprises can deploy the tool as part of internal compliance and risk-management workflows, while independent developers can use it to self-audit skills before publishing.
The company said future updates will allow everyday users to scan skills themselves before installation. The scanner has already been deployed in select Web3 AI agent infrastructure environments. Certik is also expanding integrations with additional platforms, including Finchip.ai.
“Trust is the prerequisite for any skill economy to function at scale,” said Gary Yang, incubation investor at Finchip.ai. “CertiK’s work on skill security verification is exactly what this ecosystem needs. It’s what makes Finchip’s mission of programmable skill ownership and distribution worth building.”
The launch follows Certik’s expansion into AI-focused security infrastructure. Earlier this year, the company introduced its AI Auditor initiative to address risks tied to autonomous systems and AI-driven execution environments.
“AI applications are moving toward increasingly autonomous execution, which creates a new category of security and trust challenges,” Gu said. “We believe security infrastructure for the AI era must function proactively, not reactively.”
Crypto
FBI Seizes Over $8 Billion In Cryptocurrency As Part Of The Largest Forfeiture In US Government History
The FBI seized over $8 billion in cryptocurrency, freed nearly 2,000 trafficked workers, and arrested nearly 300 people in a recent international operation.
As part of the operation, authorities shut down several “scam compounds” and crime organizations, including groups known as the Prince Group in Cambodia, Operation Sand Dollar in Dubai, and the Democratic Karen Benevolent Army in Myanmar.
“Scam compounds are modern-day criminal enterprises built to steal from Americans, launder money, and exploit trafficked workers,” FBI director Kash Patel wrote on X announcing the results of the operation.
Fox News reports that the U.S. The Democratic Karen Benevolent Army, an armed militia named after a region in Myanmar that is allegedly connected to the Chinese mob, faces sanctions imposed by the U.S. Treasury. The government has classified it as a transnational criminal organization.
Images from an operation in Thailand reveal that the FBI confiscated office supplies and thousands of smartphones.

The FBI in Dubai will extradite six of the 275 individuals they and local police detained there to the United States to face federal charges, according to the FBI. The authorities raided nine “scam compounds” in Dubai, each allegedly generating $6 million in fraud proceeds annually.
Cryptocurrency scams in the US reached a record high in 2025
In April, an FBI report revealed that cryptocurrency scams in the U.S. reached a record high in 2025, with reported losses of almost $11.4 billion. According to the FBI, cyber-enabled crimes defrauded Americans of almost $21 billion in 2025, with the costliest complaints involving cryptocurrency and artificial intelligence (AI).
“The FBI’s 2025 Internet Crime Complaint Report highlights the ever-evolving tactics of internet scammers,” the FBI’s Baltimore office wrote on X. “From fake social media profiles to voice cloning and AI-generated content, cyber criminals are evolving.”
The Internet Crime Complaint Center (IC3) received over one million complaints in 2025, up from 859,532 in 2024. The most common complaints were about investment schemes, extortion, and phishing/spoofing.
-
World2 minutes agoZelenskyy warns Russia may be preparing ‘massive’ new attack
-
News25 minutes agoTrump’s doctor recommends he lose weight and exercise more but says he is in ‘excellent health’ | CNN Politics
-
Los Angeles, Ca2 hours agoMan arrested for multiple Los Angeles freeway shootings: CHP
-
Detroit, MI2 hours ago
Archdiocese of Detroit’s list of parishes chosen for halted Masses grows
-
San Francisco, CA2 hours agoGiants reassign 3B coach Borg; Wotus named interim replacement
-
Dallas, TX2 hours agoVigil honors victims of Dallas apartment explosion that killed three and injured five
-
Miami, FL3 hours ago
Miami kosher, Mutra, restaurant earns Michelin star | The Jerusalem Post
-
Boston, MA3 hours agoRed Sox outfielder Roman Anthony suffers another injury setback