[List] Gift cards providers

[OmegaStarScream]

It wasn't a mobile topup, but last time I had an issue like that(not receiving the gift card after having paid), they replied me within one hour after sending them a message while it was late in the evening(Europe time), and I got refunded within 12 hours that is to say the next morning.

Thanks! Got my refund yesterday, finally. I guess it's different with mobile topups because they have to check with whatever service they're using for these refills. especially since on their site, I haven't received any error messages and it said it's completed.

[bullrun2024bro]

Did anyone here use the Bitrefill credit card yet?

I have been using Bitrefills gift cards quite frequently in the past, but haven't touched the credit card so far.



Source: https://www.bitrefill.com/card/?hl=en

I quickly compared the card to other existing ones (Crypto.com CC etc.) and Bitrefills card looks worse because of the 1.99% deposit fee. Anything else I am missing?

(If there is a dedicated discussion on Bitrefills cc in a different thread, please let me know).

[sabotag3x]

I quickly compared the card to other existing ones (Crypto.com CC etc.) and Bitrefills card looks worse because of the 1.99% deposit fee. Anything else I am missing?

(If there is a dedicated discussion on Bitrefills cc in a different thread, please let me know).

I have never used Bitrefill card, but CryptoCom card has an invisible fee that can be higher than 1,99% when reloading the card (ie converting crypto to fiat).. I think 'markup' is the correct term.

Here's an example (~5% fee): https://www.reddit.com/r/Crypto_com/comments/vmqa8e/spread_for_topping_up_card_is_scandalous_l/

[bullrun2024bro]

I have never used Bitrefill card, but CryptoCom card has an invisible fee that can be higher than 1,99% when reloading the card (ie converting crypto to fiat).. I think 'markup' is the correct term.

Yep, I have used Crypto.com's card in the past and if you don't pay attention you get rekt on fees (or the hidden spread the platform owners don't talk about!). However, there is a workaround, to reduce the fees by a lot:

1. Deposit BTC or any other crypto to your Crypto.com App
2. Transfer the funds from the Crypto.com App to the Crypto.com Exchange App
3. Use the orderbook, place a maker order and get filled for almost no fees
4. Transfer the FIAT from the Exchange App to your Crypto.com card for no fees

[LoyceV]

I have never used Bitrefill card, but CryptoCom card has an invisible fee that can be higher than 1,99% when reloading the card (ie converting crypto to fiat).. I think 'markup' is the correct term.

Here's an example (~5% fee): https://www.reddit.com/r/Crypto_com/comments/vmqa8e/spread_for_topping_up_card_is_scandalous_l/

Isn't that the same thing many websites do when they accept crypto? Say you're buying something for $100, they send you to their payment provider, and when you do the math you're paying $110 because everyone involved wants their cut.

[Saint-loup]

I agree but Bitrefill is reputed for using a fair rate for the purchases of its gift cards. It doesn't mean they're doing the same with their credit card but each time I've checked for gift cards purchases, it was the current price of BTC on the exchanges that had been used for the conversion. It's not the same for all gift card providers, for example when I've checked in the past, Cryptorefills was using lower rates.

[bullrun2024bro]

I agree but Bitrefill is reputed for using a fair rate for the purchases of its gift cards. It doesn't mean they're doing the same with their credit card but each time I've checked for gift cards purchases, it was the current price of BTC on the exchanges that had been used for the conversion. It's not the same for all gift card providers, for example when I've checked in the past, Cryptorefills was using lower rates.

100%, I've been using their gift cards for years now and their pricing was always fair imho.

Nevertheless this 1.99% deposit fee for every (!) deposit to your card wallet is just ridicolous. I mean you get burned every time you top it up, while other competitors don't charge this fee at all.

I really hope they update this in the future, because I doubt many users will try their card, if they learn about the fee.

[marcus222]

NOSH deserves to be on the list on the sell-side. I’ve used it with a few leftover cards and the experience was cleaner than I expected. No hidden limits, no weird verification loops, and the interface is straightforward so you’re not digging around to figure out what to do. Rates change like everywhere else, but they were competitive when I used it. What actually made me stick with it was the payout speed. It was faster than most of the older platforms I’ve tried, including some of the bigger crypto-oriented ones.

[SFR10]

NOSH deserves to be on the list on the sell-side. I’ve used it with a few leftover cards and the experience was cleaner than I expected.
...
Rates change like everywhere else, but they were competitive when I used it.

So you've never tried using their platform to sell your high-value cards? Their Android app has a lot of mixed reviews and half of them say it's a scam ^{[especially for larger amounts]}!
^{- BTW, it appears to be limited to users from "Nigeria & Ghana".}

• I'm not sure when was the last time that you tried their platform, but it appears that they've temporarily removed the option to purchase gift cards:
  
  

[LoyceV]

So you've never tried using their platform to sell your high-value cards?

You're responding to a spambot.

[DaveF]

Just as a heads up, looks like bitrefill is having some issues.
From their site as a couple of minutes ago.
Looks like it's been going on for a couple of days now.

https://x.com/bitrefill/status/2028807373725278642
And for those who do not want to click outside links

First of all, a huge thank you to everyone who has been bearing with us over the past 48 hours. It's been heartwarming to see just how many of you rely on Bitrefill in your daily lives, and we don't take that for granted.

Our entire team has been working around the clock to restore service as quickly as possible. But as much as we want to be back up and running (trust us, more than anyone), your experience comes first.

That means we're prioritizing a safe and stable relaunch. We're currently looking to bring the website and app back online during Wednesday with partial functionality - this means enabling you to access your account, spend your balance and check your gift cards. We'll follow up with specific details on what will be available at relaunch.

And again, just so you can rest easy… All your account balances, cashback, and gift cards will be right there.
As you can tell, this has been more complex to solve than we hoped, but the wait is almost over. A full technical post-mortem will be released as soon as we can.
Thank you for your patience and for sticking with us through this. 🙏

-Dave

[dkbit98]

Just as a heads up, looks like bitrefill is having some issues.
From their site as a couple of minutes ago.
Looks like it's been going on for a couple of days now.

Same here, it's not working for me, and this looks like another hack to me, but let's wait and see.
I used Biterfill few times but luckily I didn't order their KYC card or send them any of my personal details.
Does this mean their physical cards are also not functioning at the moment?

[DaveF]

Just as a heads up, looks like bitrefill is having some issues.
From their site as a couple of minutes ago.
Looks like it's been going on for a couple of days now.

Same here, it's not working for me, and this looks like another hack to me, but let's wait and see.
I used Biterfill few times but luckily I didn't order their KYC card or send them any of my personal details.
Does this mean their physical cards are also not functioning at the moment?

Since their physical cards are (were?) run by a 3rd party I would think they are still working. But no way to refill.

Going to be an interesting post when they finally tell us what happened.

-Dave

[OmegaStarScream]

The latest update (the plan is to launch tomorrow):

Update: To ensure that Bitrefill is delivering the best service for our customers, we need one more day and have to push the service relaunch to this Thursday.

We care more about safety and experience than we do about making money. We want to make sure everything is solid before we open the doors again, and that’s why we are waiting one more day.

As we've mentioned over the past few days, we detected a security breach on Sunday. We haven't been able to share much yet so as not to interfere with the ongoing onchain and offchain investigations, and allow our cybersecurity partners and team members to do their thing. We'll share more details tomorrow along with the relaunch announcement.

Your account balances, cashback, and gift cards will all be right where you left them.

Thank you for hanging in there with us. We're almost there.

[DaveF]

And they are back (sort of)

https://x.com/bitrefill/status/2029521535824953829

We're back up. Mostly.

We expect everything to be back to normal within a couple of days. You can check live updates on what's working now here: https://bitrefill.com/service


Bitrefill was the target of a breach from a high-profile hacker group. As soon as our team realized an attack was ongoing, we took the website and app down, and since then we have been working 24/7 to get the site back up in a safe way, which we are now doing. We’ve gotten help from top cybersecurity experts, onchain analytics and law enforcement, to understand what happened and how. We have a pretty clear image of that (hello 🇰🇵) and will publish more information about what happened as soon as we have time to write it all up.

TL;DR: User gift cards, store credits, KYC info are unharmed. Bitrefill took a hit, our customers did not.

Again, thanks for your patience and your continued trust. We’ll be back to our full self shortly.

So, if the above is true it was their wallet server / payment server that took the hit.

-Dave

[OmegaStarScream]

Looks like all of Bitrefill's services are back online (since they relaunched): https://www.bitrefill.com/service

With the exception of some payment methods still being disabled.

[sabotag3x]

Update on the attack on Bitrefill.. hackers from North Korea compromised an employee’s laptop, enabling the theft of gift cards and some hot wallets.

Some customer data was also leaked, although it was not the main target.

March 1st incident report

On March 1, 2026, Bitrefill was the target of a cyberattack. Based on indicators observed during the investigation  - including the modus operandi, the malware used, on-chain tracing and reused IP + email addresses (!) - we find many similarities between this attack and past cyberattacks by the DPRK Lazarus / Bluenoroff group against other companies in the crypto industries.

The initial access originated through a compromised employee laptop, from which a legacy credential was exfiltrated. That credential provided access to a snapshot containing production secrets. From there, the attackers were able to escalate their access to our broader infrastructure, including parts of our database and certain cryptocurrency wallets.

We first detected the incident after noticing suspicious purchasing patterns with certain suppliers. We realized that our gift card stock and supply lines were being exploited. At the same time we found some of our hot wallets being drained and funds transferred to attacker-controlled wallets. The moment we identified the breach, we took all of our systems offline as part of our containment response.

Bitrefill operates a global e-commerce business with dozens of suppliers, thousands of products, and multiple payment methods across many countries. Safely switching all these things off and bringing them back online is not trivial.

Since the incident, our team has been working closely with top industry security researchers, incident response specialists, on-chain analysts and law enforcement to understand what happened and how we can prevent it from happening again. A sincere thank you to @zeroshadow_io, @SEAL_Org, @RecoverisTeam and @fearsoff for their rapid response and support throughout this ordeal.

What about your data

Based on our investigation and our logs we don’t have reason to think that customer data was the target of this breach. There is no evidence that they extracted our entire database, only that the attackers ran a limited number of queries consistent with probing to understand what there was to steal, including cryptocurrency and Bitrefill gift card inventory.

Bitrefill was designed to store very little personal data. We are a store, not a crypto service provider. We don’t require mandatory KYC. When a customer chooses to verify their account - e.g. to access higher purchasing tiers or certain products - that data is kept exclusively with our external KYC provider, with no backups in our system.

Still, based on database logs, we know that a subset of purchase records was accessed and we want to be transparent about that.

Around 18,500 purchase records were accessed by the attackers. Those records contained limited customer information, such as email addresses, crypto payment address, and metadata including IP address.

For approximately 1,000 purchases, specific products required customers to provide a name. That information is encrypted in our database. However, since the attackers may have gotten access to the encryption keys, we are treating this data as potentially accessed. Customers in this category have already been notified directly by email.

At this time, based on the information currently available, we do not believe customers need to take specific action. As a precaution, we recommend remaining cautious of any unexpected communications related to Bitrefill or crypto. If this assessment changes, we will of course immediately inform those affected.

What we are doing

We have already significantly improved our cybersecurity practices, but vow to continue to draw learnings from this experience to make sure user and company balances and data remain maximally safe. Specifically we’re:

-Continuing thorough cybersecurity reviews and pentests with multiple external experts and implementing recommendations;
-Further tightening internal access controls;
-Further improving logging and monitoring for faster detection and more effective response; and
-Continuing to refine and test our incident response procedures and automated shutdown procedures.

The bottom line

Getting hit by a sophisticated attack sucks (a lot). We’ve been in business for over 10 years and it’s the first time we’ve been hit this hard. But we survived.

Bitrefill was designed to limit the impact if something like this ever happened. Bitrefill remains well funded, has been profitable for several years and will absorb these losses from our operational capital.

Almost everything is back to normal: payments, stock, accounts. Sales volumes are also back to normal, and we are eternally thankful to our customers for your continued confidence in us.

We will continue to do our best to continue deserving your trust.

Thank you!

[dkbit98]

Update on the attack on Bitrefill.. hackers from North Korea compromised an employee’s laptop, enabling the theft of gift cards and some hot wallets.

Oh would you please give me a break....it is always some unkonwn ''evil'' hackers from North Korea doing this, year right 
I don't buy that story, but they clearly had some breach of customer personal information, and I am most concerned about physical cards they sold.
They all contained real names with delivery addresses, and from reading this tweet I see that Bitrefill is not even sure what exactly was leaked 

[satscraper]

but they clearly had some breach of customer personal information,

Yeah, they clearly had.

 This incident reinforced my opinion that any hot wallet ^{whether it’s managed by the large exchange or by  individual} is not suitable for securely holding crypto. What puzzles me is that Bitrefill still relies on hot wallets instead of adopting  much safer MPC wallet. In that respect  Binance  which has already adopted MPC model  is far ahead.

[rat03gopoh]

What puzzles me is that Bitrefill still relies on hot wallets instead of adopting  much safer MPC wallet.

I think it's because they're focused on tx speed, which aligns with their business model. MPC means more verifications and approvals are needed which might one of sacrifices service strengths.
I also haven't seen any reports of financial losses from this attack, so it's likely not significant (and likely will always be), so they still have an excuse for not wanting to implement an overly complex security model.