Bitrefill Identifies Lazarus Group Behind Cyberattack and Stolen Funds

By: crypto insight|2026/03/19 00:00:00

Key Takeaways:

Bitrefill suffered a cyberattack on March 1, likely orchestrated by the infamous Lazarus Group using sophisticated techniques.
The company’s operational capital will cover the financial losses, although the exact amount remains undisclosed.
Approximately 18,500 purchase records were accessed, but there’s no evidence of a full database breach.
Bitrefill has enhanced its cybersecurity measures and partnered with leading security firms to reinforce defenses.
Despite increased security across the industry, advanced hacks continue to pose significant threats, with Lazarus Group being a major adversary.

WEEX Crypto News, 2026-03-18 14:26:21

Cybersecurity Breach and Financial Loss

Bitrefill, recognized for allowing crypto spending on tangible products, faced a significant hacking event on March 1. The breach, attributed to the notorious Lazarus Group, compromised an employee’s laptop via malware and reused infrastructure, leading to significant fund extraction from Bitrefill’s hot wallets. Navyand the exact amount remains undisclosed; Bitrefill assures that operational capital will cover the financial setback. The breach exposed 18,500 purchase records, albeit limited customer data was affected. Importantly, no full database extraction occurred according to the company’s investigation.

Methods and Potential Involvement of BlueNoroff

The modus operandi closely matches that of the Lazarus Group, a formidable North Korean cyber entity known for high-profile crypto heists, including the record-breaking Bybit breach of 2025. Bitrefill also highlighted BlueNoroff, another North Korean group with ties to Lazarus, as a possible accomplice or even the sole actor in this attack timeline. These threat actors are infamous for exploiting system vulnerabilities with tactics steeped in stealth and precision, often employing complex on-chain tracing techniques.

Financial Integrity Amidst Attack

In the aftermath, Bitrefill assured stakeholders of the platform’s resilience. With the company’s financial framework absorbing the attack’s brunt, operations resumed smoothly. “Almost everything is back to normal: payments, stock, accounts,” Bitrefill expressed gratitude to its users for their undeterred trust. The resilience highlights a crucial aspect of modern crypto businesses—maintaining integrity despite facing formidable cyber adversaries.

-- Price

Rampant Threats in the Crypto Industry

The Lazarus Group, notorious for its sophisticated attacks, continues to reign as one of the industry’s fiercest threats. Despite advancements in crypto security protocols, hackers persistently exploit weaknesses. The $1.4 billion Bybit heist showcases the magnitude these cyber threats can reach. It’s a stark reminder of the constant vigilance required to safeguard digital assets.

Reinforced Security Infrastructure

Bitrefill has since fortified its cybersecurity defense mechanisms through in-depth collaborations with firms like Security Alliance, FearsOff Security, Recoveris.io, and zeroShadow. The development followed an immediate system shutdown to mitigate breach impacts. New measures include comprehensive security auditing with esteemed researchers and adopting their insights, tightening internal controls, and boosting real-time monitoring for prompt threat detection. These proactive strategies reflect a commitment to harden defenses against evolving cyber threats.

Growing Cybersecurity and Market Dynamics

With incidents of breaches remaining prevalent, the crypto realm is witnessing a significant evolution in cybersecurity strategies. The rise in digital adoption and innovative financial products propels the necessity for airtight security protocols. Lazarus Group’s relentless pursuits underline the importance for platforms like Bitrefill to stay a step ahead in thwarting potential threats. It’s crucial for enterprises in the space to strike a balance between seamless user experience and robust security safeguards.

Future Outlook and Industry Confidence

Looking forward, Bitrefill’s response to the cyberattack reflects broader industry trends towards reinforcing security postures. As hackers refine their methodologies, crypto platforms must anticipate threats before they materialize. The industry can leverage these challenges to innovate, shifting focus from damage control to proactive security frameworks. Reinforcing customer trust remains paramount, as trust cements the foundation of digital asset ecosystems.

FAQs

What was the main method used by the Lazarus Group to infiltrate Bitrefill’s systems?

The hackers employed malware, on-chain tracing, and reused IP and email infrastructure to compromise an employee’s laptop, leading to the financial breach and data exposure.

What measures has Bitrefill implemented following the attack?

Following the incident, Bitrefill conducted a cybersecurity review and fortified its systems by tightening internal access controls and enhancing real-time monitoring strategies with leading security firms.

Did the attackers access Bitrefill’s entire database?

No, Bitrefill found no evidence of full database extraction, noting the attackers only carried out limited queries aimed at identifying potential assets to target.

How is Bitrefill handling the financial losses incurred from the breach?

Bitrefill will absorb the financial losses using its operational capital, ensuring continued smooth platform operations without impacting customer trust.

Why is the Lazarus Group considered a significant threat to the crypto industry?

The Lazarus Group has masterminded some of the largest and most sophisticated crypto heists in history, utilizing advanced techniques to bypass even the most robust security measures, exemplifying their persistent threat to the industry.

On March 16, 2026, in Dallas, Texas, USA, CanGu Company (New York Stock Exchange code: CANG, hereinafter referred to as "CanGu" or the "Company") today announced its unaudited financial performance for the fourth quarter and full year ended December 31, 2025. As a btc-42">bitcoin mining enterprise relying on a globally operated layout and dedicated to building an integrated energy and AI computing power platform, CanGu is actively advancing its business transformation and infrastructure development.

2025 Full Year and Fourth Quarter Financial and Operational Highlights

• Financial Performance:

Total revenue for the full year 2025 was $688.1 million, with $179.5 million in the fourth quarter.

Bitcoin mining business revenue for the full year was $675.5 million, with $172.4 million in the fourth quarter.

Full-year adjusted EBITDA was $24.5 million, while the fourth quarter was -$156.3 million.

• Mining Operations and Costs:

A total of 6,594.6 bitcoins were mined throughout the year, averaging 18.07 bitcoins per day; of which 1,718.3 bitcoins were mined in the fourth quarter, averaging 18.68 bitcoins per day.

The average mining cost for the full year (excluding miner depreciation) was $79,707 per bitcoin, and for the fourth quarter, it was $84,552;

The all-in sustaining costs were $97,272 and $106,251 per bitcoin, respectively.

As of the end of December 2025, the company has cumulatively produced 7,528.4 bitcoins since entering the bitcoin mining business.

• Strategic Progress:

The company has completed the termination of the American Depositary Receipt (ADR) program and transitioned to a direct listing on the NYSE to enhance information transparency and align with its strategic direction, with a long-term goal of expanding its investor base.

CEO Paul Yu stated: "2025 marked the company's first full year as a bitcoin mining enterprise, characterized by rapid execution and structural reshaping. We completed a comprehensive adjustment of our asset system and established a globally distributed mining network. Additionally, the company introduced a new management team, further strengthening our capabilities and competitive advantage in the digital asset and energy infrastructure space. The completion of the NYSE direct listing and USD pricing also signifies our transformation into a global AI infrastructure company."

"As we enter 2026, the company will continue to optimize its balance sheet structure and enhance operational efficiency and cost resilience through adjustments to the miner portfolio. At the same time, we are advancing our strategic transformation into an AI infrastructure provider. Leveraging EcoHash, we will utilize our capabilities in scalable computing power and energy networks to provide cost-effective AI inference solutions. The relevant site transformations and product development are progressing simultaneously, and the company is well-positioned to sustain its execution in the new phase."

The company's Chief Financial Officer, Michael Zhang, stated: "By 2025, the company is expected to achieve significant revenue growth through its scaled mining operations. Despite recording a net loss of $452.8 million from ongoing operations, mainly due to one-time transformation costs and market-driven fair value adjustments, the company, from a financial perspective, will reduce its leverage, optimize its Bitcoin reserve strategy and liquidity management, introduce new capital to strengthen its financial position, and seize investment opportunities in high-potential areas such as AI infrastructure while navigating market volatility."

Fourth Quarter 2025 Ongoing Operations Financial Performance

Revenue

The total revenue for the fourth quarter was $1.795 billion. Of this, the Bitcoin mining business contributed $1.724 billion in revenue, generating 1,718.3 Bitcoins during the quarter. Revenue from the international automobile trading business was $4.8 million.

Operating Costs and Expenses

The total operating costs and expenses for the fourth quarter amounted to $4.56 billion, primarily attributed to expenses related to the Bitcoin mining business, as well as impairment of mining machines and fair value losses on Bitcoin collateral receivables.

This includes:

· Cost of Revenue (excluding depreciation): $1.553 billion

· Cost of Revenue (depreciation): $38.1 million

· Operating Expenses: $9.9 million (including related-party expenses of $1.1 million)

· Mining Machine Impairment Loss: $81.4 million

· Fair Value Loss on Bitcoin Collateral Receivables: $171.4 million

Profit Situation

The operating loss for the fourth quarter was $276.6 million, a significant increase from a loss of $0.7 million in the same period of 2024, primarily due to the downward trend in Bitcoin prices.

The net loss from ongoing operations was $285 million, compared to a net profit of $2.4 million in the same period last year.

The adjusted EBITDA was -$156.3 million, compared to $2.4 million in the same period last year.

Full Year 2025 Ongoing Operations Financial Performance

Revenue

The total revenue for the full year was $6.881 billion. Of this, the revenue from the Bitcoin mining business was $6.755 billion, with a total output of 6,594.6 Bitcoins for the year. Revenue from the international automobile trading business was $9.8 million.

Operating Costs and Expenses

The total annual operating costs and expenses amount to $1.1 billion.

Specifically, they include:

· Revenue Cost (excluding depreciation): $543.3 million

· Revenue Cost (depreciation): $116.6 million

· Operating Expenses: $28.9 million (including related-party expenses of $1.1 million)

· Miner Impairment Loss: $338.3 million

· Bitcoin Collateral Receivable Fair Value Change Loss: $96.5 million

Profitability

The full-year operating loss is $437.1 million. The continuing operations net loss is $452.8 million, while in 2024, there was a net profit of $4.8 million.

The 2025 non-GAAP adjusted net profit is $24.5 million (compared to $5.7 million in 2024). This measure does not include share-based compensation expenses; refer to "Use of Non-GAAP Financial Measures" for details.

Financial Position

As of December 31, 2025, the company's key assets and liabilities are as follows:

· Cash and Cash Equivalents: $41.2 million

· Bitcoin Collateral Receivable (Non-current, related party): $663.0 million

· Miner Net Value: $248.7 million

· Long-Term Debt (related party): $557.6 million

In February 2026, the company sold 4,451 bitcoins and repaid a portion of related-party long-term debt to reduce financial leverage and optimize the asset-liability structure.

Stock Repurchase

As per the stock repurchase plan disclosed on March 13, 2025, as of December 31, 2025, the company had repurchased a total of 890,155 shares of Class A common stock for approximately $1.2 million.

The US AI Startup Is Loving China's Open Source Model

80% of US AI Startups Are Using Chinese Open Source Models

Three Weeks of the US-Iran War: Who's Making Money, Who's Paying the Bill?

Global Losing 10 Million Barrels of Oil Each Day, Russia Earns Over $800 Million in Just Over Two Weeks