North Korea-linked BlueNoroff (a Lazarus APT subgroup) breached Bitrefill’s production infrastructure in early March 2026, beginning with a compromised employee laptop and moving laterally to cryptocurrency hot wallets and internal secrets. Approximately 18,500 customer purchase records were exposed; attacker access to decryption keys may extend the effective exposure well beyond that count. The incident demonstrates that nation-state actors are actively targeting cryptocurrency platforms for direct financial theft, and any organization holding crypto assets or encrypted customer data faces comparable risk.