The March 2026 breach, in full
This is the part other reviews skip, so we will do it first.
On 1 March 2026, an employee laptop was compromised. The attackers recovered legacy credentials from it, which gave them access to production systems. From there they reached production keys, interfered with gift-card supply chains, and drained funds from the company's hot wallets before Bitrefill took systems offline.
Bitrefill disclosed the incident publicly on 17 March 2026. The data exposed covered approximately 18,500 purchase records, including customer email addresses, cryptocurrency payment addresses and IP addresses, with customer names in around 1,000 cases. The company attributed the attack to the Lazarus Group, citing modus operandi, malware used, on-chain tracing and reused IP and email addresses, and said it would cover all losses from operating capital. Services have since returned to normal.
Catalogue and coverage
Around 8,000 brands across 170+ countries, and in practice the depth matters more than the headline. Where Bitrefill separates from competitors is the long tail: regional supermarket chains, local utility providers, smaller mobile carriers, and bill-payment products that other platforms do not carry.
Mobile top-up coverage is a genuine strength, including US carriers such as Verizon, T-Mobile and Mint Mobile alongside international networks. For anyone using crypto to support family abroad, that is the most useful part of the product — see mobile top-ups with crypto.
Weaknesses in coverage are regional rather than categorical. Some markets are thin, and stock on specific regional variants of popular brands comes and goes. Always confirm the region on the product page rather than assuming — the region lock is set by the brand and Bitrefill cannot override it.
Fees and what you really pay
Most brands sell at face value. The exceptions are consistent across the market: Amazon at up to about 2%, and prepaid Visa and Mastercard products, which carry issuer fees on top of any platform margin.
The number that actually varies is the exchange rate you are quoted. Bitrefill prices competitively in our experience, and "competitively" is not the same as "at mid-market". Do the division:
| Paying in | Network cost on a $25 card | Speed | Verdict |
|---|---|---|---|
| BTC over Lightning | Fractions of a cent | Sub-second | The reason to use this platform |
| Litecoin | A few cents | ~2.5 min | Excellent fallback |
| USDT on a cheap chain | Cents | Seconds | No rate drift — best for larger orders |
| BTC on-chain | Can exceed the card's entire markup | 10+ min | Avoid under $50 |
Full method in crypto gift card fees.
KYC and privacy
No identity verification for standard gift cards and top-ups at ordinary amounts — guest checkout with an email address is sufficient. That is genuine and it is one of the main reasons people choose the platform.
Two caveats. Prepaid card products require full verification, because the card issuer's rules apply rather than Bitrefill's. And "no KYC" was never "anonymous", which the March 2026 breach demonstrated more vividly than any argument could — see buying gift cards privately.
Sats back
Bitcoin cashback of 1–10% on selected products, plus 1–2% on the Bitrefill Visa debit card where available. Rates vary by brand and campaign, and change without notice.
The arithmetic that matters: a 3% rebate on a card sold at face value is a genuine 3% discount on spending you were doing anyway. A 3% rebate on a card sold at a 5% markup is still a 2% loss. Always net the rebate against the price — crypto cashback and rewards compares the live programmes on the same monthly spend.
Pros and cons
What works well
- The deepest catalogue in the category — around 8,000 brands across 170+ countries
- Genuine Lightning Network support, which makes small orders economical instead of absurd
- No identity verification for most standard gift-card orders
- Sats-back rewards of 1–10% on selected products, which on a face-value card is a real discount
- Strong mobile top-up coverage including US carriers such as Verizon, T-Mobile and Mint Mobile
- A named Swedish legal entity with a decade of operating history
What to watch out for
- Breached on 1 March 2026 — roughly 18,500 purchase records exposed, hot wallets drained, attributed to the Lazarus Group
- Amazon and prepaid card products carry a markup of up to about 2%
- Prepaid card products require full identity verification, which surprises people who chose Bitrefill for its no-KYC reputation
- Rewards rates change without notice and vary sharply by brand
- Support is email-based and slows noticeably during high-volume periods
Who should use it
Bitrefill is the right choice if
- You hold Bitcoin and want Lightning payments, which no competitor matches.
- You buy small amounts frequently — top-ups, weekly grocery cards, subscriptions.
- You need the long tail: regional retailers, local utilities, smaller carriers.
- You want rewards on spending you were doing anyway.
- You are comfortable running basic compartmentalisation — separate email, unique password, no stored balance.
Look elsewhere if
- You hold an altcoin Bitrefill does not accept — Coinsbee takes 200+.
- You want Monero accepted — CoinCards does.
- You specifically want a MiCA-authorised EU counterparty — CoinGate.
- The 2026 breach is a dealbreaker for you. That is a reasonable position, and the alternatives page is organised around it.
Head-to-head with the other big player: Bitrefill vs Coinsbee. Scored against the whole field: best crypto gift card platforms.
Bitrefill: FAQ
Is Bitrefill legit?
Yes. Bitrefill AB is a Swedish company that has operated since 2015 and is one of the two largest platforms in this category. "Legit" and "never had a security incident" are different questions, though — it suffered a serious breach in March 2026, disclosed it publicly, attributed it to the Lazarus Group and said it would cover losses from operating capital.
Is Bitrefill safe to use after the 2026 hack?
We still use it, with changed habits. The breach exposed purchase records rather than allowing attackers to spend your money, and the company's handling was transparent. What it proves is that a gift-card platform holds a list of people who own crypto with wallet addresses attached — so use a dedicated email address, a unique password, and do not leave a balance in the account.
Does Bitrefill require KYC?
Not for standard gift cards and top-ups at ordinary amounts. It does for prepaid card products, because that requirement comes from the card issuer rather than from Bitrefill. Large or unusual orders can also trigger a request. See no-KYC gift cards.
What are Bitrefill's fees?
Most brands sell at face value. Amazon and prepaid cards carry up to about 2%. On top of that sits the exchange rate you are quoted, which is where the real variance lives — run the check in hidden markup before you pay.
What is sats back?
A rewards programme paying Bitcoin cashback on selected purchases, typically between 1% and 10% depending on the brand and any live campaign. On a card sold at face value, a 3% rebate makes the purchase genuinely cheaper than paying with a debit card — which is the only situation in this market where that is true.
What are the best Bitrefill alternatives?
Coinsbee if you hold altcoins, CoinCards for Canada or Monero, CoinGate for a MiCA-authorised EU counterparty, and eGifter for US buyers who want conventional retail support. Full ranking in nine Bitrefill alternatives.
Sources and further reading
Figures on this page were checked in August 2026. Fees, country lists and promotions change without notice — always confirm on the operator's own site before you pay.
- Bitrefill — brand count, coin support, stated fees and rewards
- CoinDesk — Bitrefill blames Lazarus for compromising 18,500 purchase records — primary reporting on the breach
- SC Media — Bitrefill pins hack on Lazarus Group — attribution and scope
- UpGuard — Bitrefill investigating cyberattack — incident timeline and data types