Connect with us

Crypto

Bitrefill blames North Korea-linked Lazarus hacker group for compromising 18,500 purchase records

Published

on

Bitrefill blames North Korea-linked Lazarus hacker group for compromising 18,500 purchase records

Cryptocurrency payments and gift card platform Bitrefill has blamed the North Korea-linked hacking group Lazarus for a cyberattack on March 1, 2026, that compromised parts of its infrastructure and cryptocurrency wallets.

The attackers gained access to production keys, transferred funds from hot wallets, and exposed 18,500 purchase records containing emails, payment addresses, and IP addresses.

Approximately 1,000 records included encrypted usernames. Affected users were notified. Operations have resumed, with the company announcing to cover losses from operational capital. The incident underscores the importance of vigilance regarding crypto and on-chain security.

The modus operandi included malware, on-chain tracing and reused IP and email addresses and was similar to previous attacks attributed to North Korea’s Lazarus Group, also known as Bluenoroff, the company said in a detailed report on X.

The Lazarus Group has previously targeted crypto projects including Ronin Network, Harmony’s Horizon Bridge, WazirX, and Atomic Wallet.

Advertisement

How the attack unfolded

It all began with with a compromised employee laptop, which exposed legacy credentials and allowed attackers to access Bitrefill’s broader infrastructure, including parts of its database and cryptocurrency wallets.

The breach quickly became apparent when the company noticed unusual purchasing patterns among certain suppliers, signaling that attackers were exploiting its gift card inventory and supply chains. The firm also noted that attackers were draining some hot wallets and moving funds to their own addresses, following which, the system was taken offline to contain the damage.

“Bitrefill operates a global e-commerce business with dozens of suppliers, thousands of products, and multiple payment methods across many countries. Safely switching all these things off and bringing them back online is not trivial,” the company said in a statement.

Since the incident, Bitrefill has been working with security researchers, incident response teams, on-chain analysts, and law enforcement to investigate the breach.

Customer data impact

Hackers accessed a small set of purchase records, approximately 18,500, containing

Advertisement

Bitrefill said there is no evidence that customer data was a primary target. Its logs indicate that attackers ran a limited number of queries aimed at cryptocurrency holdings and gift card inventory rather than extracting the entire database.

The platform stores minimal personal data and does not require mandatory KYC. A small subset of purchase records, approximately 18,500, was accessed, containing information such as email addresses, crypto payment addresses, and metadata including IP addresses. About 1,000 records contained encrypted names for specific products; the company is treating this data as potentially compromised and has notified affected customers directly by email.

At present, Bitrefill does not believe customers need to take any additional action, though it advises caution regarding unexpected communications related to Bitrefill or cryptocurrency.

Steps to strengthen security

In response to the breach, Bitrefill said it has already strengthened its cybersecurity practices and is working to draw lessons from the incident.

The company outlined several measures, including conducting comprehensive penetration tests with external experts, tightening internal access controls, enhancing logging and monitoring for faster threat detection, and refining incident response procedures and automated shutdown protocols.

Advertisement

Looking forward

Bitrefill acknowledged that this was its first major attack in more than a decade of operation but stressed that it remains well-funded and profitable, capable of absorbing operational losses. Most systems, including payments, stock, and accounts, are back online, with sales volumes returning to normal.

“Getting hit by a sophisticated attack sucks (a lot),” the company said. “But we survived. We will continue to do our best to continue deserving our customers’ trust.”

Crypto

Stablecoin Settlement Is Here, but Seamless Off-Chain Money Movement Is Not | PYMNTS.com

Published

on

Stablecoin Settlement Is Here, but Seamless Off-Chain Money Movement Is Not | PYMNTS.com

The stablecoin industry has spent years trying to prove one thing above all else: that blockchain-based money can move faster, cheaper and more efficiently than the financial infrastructure it hopes to replace.

This week, the industry produced another wave of evidence that the technology itself is working as advertised.

Project Agora, the Bank for International Settlements (BIS) initiative involving seven central banks and more than 40 private-sector financial institutions, successfully tested blockchain-based cross-border settlement flows. SoFi became the first national bank to issue a stablecoin on a public blockchain. Circle expanded its payout infrastructure through a partnership with Nium, while Mastercard secured a New York cryptocurrency license that broadens its stablecoin-related capabilities, and Cash App rolled out support for stablecoin payments.

But the digital dollar industry is now approaching a more difficult phase of development where success will be measured not by how quickly stablecoins move between wallets but by whether businesses and consumers can use those assets in the real economy without introducing new friction, cost or complexity.

The first challenge was proving that value can move on chain. The next challenge is figuring out how that value becomes economically useful once it moves off chain.

Advertisement

See also: Stablecoins Target B2B Settlement as Marketplaces Scale 

Advertisement: Scroll to Continue

Interoperability Is More Important Than Issuance

The stablecoin market spent years focused on issuance scale. Tether and Circle competed for circulation dominance. New entrants launched chain-specific coins designed to drive ecosystem growth. But fragmentation is now becoming a structural challenge.

Stablecoins exist across multiple public blockchains, private ledgers, Layer 2 networks and emerging tokenized deposit systems. Financial institutions are simultaneously experimenting with permissioned blockchain environments while FinTechs continue building on open public chains.

But a payment system only becomes economically powerful when participants can transact across networks without introducing new operational complexity. If businesses must manage liquidity across multiple chains, maintain separate compliance processes or navigate inconsistent standards, the efficiency gains of blockchain settlement begin to erode. The future payments ecosystem is unlikely to converge around a single blockchain or a single stablecoin issuer. More likely, it will consist of multiple interoperable systems that require governance standards, messaging frameworks, compliance coordination and liquidity routing mechanisms.

Advertisement

“I think we go to a world built on digital network transfers of value rather than the message-based system we have today. The future of digital networks is going to be a multi-network world,” J. Christopher Giancarlo, former Commodity Futures Trading Commission (CFTC) chair and co-founder of the Digital Dollar Project, told PYMNTS on the latest episode of “From the Block.”

Project Agora’s significance lies partly in its recognition of this issue. The initiative explores how central bank money and commercial bank tokenization models can interact within shared programmable infrastructures rather than isolated silos.

See more: Fed Report Shows Crypto Still Has an Everyday Use Problem

Off-Ramps Are Becoming Stablecoins’ Biggest Adoption Bottleneck

The stablecoin ecosystem increasingly resembles a high-speed highway system that feeds into underdeveloped local roads. On-chain transfers may settle instantly, but businesses and consumers still operate inside local banking systems, regulatory frameworks, tax regimes, treasury processes and compliance structures that were not designed for tokenized money.

The result is that the “last mile” of stablecoin adoption often introduces many of the same frictions blockchain was supposed to eliminate. Findings in the March PYMNTS Intelligence report “Stablecoins Gain Ground: Why CFOs See More Promise There Than in Crypto” revealed that while 42% of middle-market companies have at least discussed stablecoins, only 13% have reported actual stablecoin use.

Advertisement

This is why partnerships like Circle’s integration with Nium matter as much as the blockchain itself. The competitive battleground is shifting away from token issuance and toward payout orchestration, banking connectivity, liquidity management and compliance automation.

SoFi’s entrance into public-blockchain stablecoins also illustrates that convergence. Traditional financial institutions are no longer merely partnering with crypto-native firms; they are directly participating in issuance and infrastructure development. Mastercard’s expanding regulatory footprint signals a similar shift.

The stablecoin networks that achieve mainstream scale are likely to be the ones that balance openness with institutional trust. Too much decentralization can create compliance uncertainty. Too much centralization can undermine the efficiency and programmability advantages that made blockchain attractive in the first place. 

Because the value proposition is not “crypto.” It is operational efficiency.

Advertisement
Continue Reading

Crypto

Certik Unveils ‘Anti-Virus for AI Agents’ as Skill Marketplaces Face Hidden Threats

Published

on

Certik Unveils ‘Anti-Virus for AI Agents’ as Skill Marketplaces Face Hidden Threats

Key Takeaways

The Security Challenge

Blockchain and AI security firm Certik, on May 27, unveiled a new security platform designed to evaluate risks in third-party artificial intelligence (AI) skills. Dubbed the “anti-virus for AI agents,” the release comes amid growing industry concern over the security of AI skill marketplaces.

Security researchers have warned that many of these skills are unvetted, can execute system-level actions and may contain hidden malicious behavior, creating a new software supply chain risk for the AI era. Security audits across the sector have identified risks ranging from credential harvesting and data exfiltration to fund-transfer manipulation and prompt-based override attacks.

Despite these concerns, AI skill marketplaces have expanded rapidly as agent ecosystems mature. However, unlike traditional app stores, most skills are sourced from public repositories with little or no review. Analysts say this creates opportunities for attackers to embed harmful instructions, trigger unauthorized data access or manipulate autonomous execution flows.

In a recent blog post, Certik said its skill scanner platform is designed specifically to evaluate risks that emerge during execution, including scenarios involving financial transactions or fund calls. The scanner produces a numerical score from 0 to 100, along with “pass,” “warn” or “fail” verdicts and categorized findings. According to the company, the system achieves up to 90.5% precision in identifying security risks.

“As AI agents become more deeply integrated into financial systems, enterprise workflows and everyday digital interactions, the security model around third-party skills becomes critically important,” said Ronghui Gu, Certik’s CEO and co-founder. “CertiK Skill Scanner was built to establish a standardized trust layer before execution, helping users and platforms identify hidden risks before sensitive data, assets or systems are exposed.”

Certik said AI skill marketplaces can integrate the scanner directly into publishing pipelines, automatically reviewing skills before they go live and displaying security verdicts to users. Enterprises can deploy the tool as part of internal compliance and risk-management workflows, while independent developers can use it to self-audit skills before publishing.

Advertisement

The company said future updates will allow everyday users to scan skills themselves before installation. The scanner has already been deployed in select Web3 AI agent infrastructure environments. Certik is also expanding integrations with additional platforms, including Finchip.ai.

“Trust is the prerequisite for any skill economy to function at scale,” said Gary Yang, incubation investor at Finchip.ai. “CertiK’s work on skill security verification is exactly what this ecosystem needs. It’s what makes Finchip’s mission of programmable skill ownership and distribution worth building.”

The launch follows Certik’s expansion into AI-focused security infrastructure. Earlier this year, the company introduced its AI Auditor initiative to address risks tied to autonomous systems and AI-driven execution environments.

“AI applications are moving toward increasingly autonomous execution, which creates a new category of security and trust challenges,” Gu said. “We believe security infrastructure for the AI era must function proactively, not reactively.”

Advertisement
Continue Reading

Crypto

FBI Seizes Over $8 Billion In Cryptocurrency As Part Of The Largest Forfeiture In US Government History

Published

on

FBI Seizes Over  Billion In Cryptocurrency As Part Of The Largest Forfeiture In US Government History
iStockphoto composite

The FBI seized over $8 billion in cryptocurrency, freed nearly 2,000 trafficked workers, and arrested nearly 300 people in a recent international operation.

As part of the operation, authorities shut down several “scam compounds” and crime organizations, including groups known as the Prince Group in Cambodia, Operation Sand Dollar in Dubai, and the Democratic Karen Benevolent Army in Myanmar.

“Scam compounds are modern-day criminal enterprises built to steal from Americans, launder money, and exploit trafficked workers,” FBI director Kash Patel wrote on X announcing the results of the operation.

Fox News reports that the U.S. The Democratic Karen Benevolent Army, an armed militia named after a region in Myanmar that is allegedly connected to the Chinese mob, faces sanctions imposed by the U.S. Treasury. The government has classified it as a transnational criminal organization.

Images from an operation in Thailand reveal that the FBI confiscated office supplies and thousands of smartphones.

Advertisement
seized-devices-from-an-FBI-anti-scam-operation-in-Thailand
FBI

The FBI in Dubai will extradite six of the 275 individuals they and local police detained there to the United States to face federal charges, according to the FBI. The authorities raided nine “scam compounds” in Dubai, each allegedly generating $6 million in fraud proceeds annually.

Cryptocurrency scams in the US reached a record high in 2025

In April, an FBI report revealed that cryptocurrency scams in the U.S. reached a record high in 2025, with reported losses of almost $11.4 billion. According to the FBI, cyber-enabled crimes defrauded Americans of almost $21 billion in 2025, with the costliest complaints involving cryptocurrency and artificial intelligence (AI).

“The FBI’s 2025 Internet Crime Complaint Report highlights the ever-evolving tactics of internet scammers,” the FBI’s Baltimore office wrote on X. “From fake social media profiles to voice cloning and AI-generated content, cyber criminals are evolving.”

The Internet Crime Complaint Center (IC3) received over one million complaints in 2025, up from 859,532 in 2024. The most common complaints were about investment schemes, extortion, and phishing/spoofing.

Advertisement
Continue Reading
Advertisement

Trending