Bitrefill sells gift cards to people who never give a name. In March, 18,500 of those buyers' emails, IPs and wallet addresses walked out.

How it works

Bitrefill is a merchant, not an exchange. You pick from a catalogue of roughly 8,000 gift cards, eSIMs, mobile top-ups and bill payments across more than 180 countries, pay in Bitcoin, Lightning, Ethereum, Litecoin, Solana, USDT or USDC, and a redemption code lands in your inbox within seconds. Nothing is held on your behalf unless you deliberately buy store credit, which is the one custodial corner of the product.

The legal structure is split and published. Airfill Prepaid AB, a Swedish company registered 559001-6035, sells the gift cards and top-ups; Airfill US LLC in Delaware runs the US card and bill payments; a separate El Salvador entity handles bill payments there. The terms are governed by Swedish law with exclusive jurisdiction in Stockholm.

Checkout works without an account. Bitrefill asks for a working email or phone number, verifies it, and delivers the code there. An account buys higher limits, order history, saved wallets and store credit — none of which you need to complete a purchase.

KYC & privacy

Bitrefill is the rare service that prices each rung of the identity ladder in public. With no account: 15 gift cards a day, capped at $500 a day and $1,000 a month. With an email-verified account: $2,000 per card, $5,000 a day, $10,000 a month. With a verified account — government photo ID, proof of address and a live selfie, processed by Sumsub — $10,000 a day and $50,000 a month.

What the terms add is that the ladder is not the only trigger. Purchases are "continuously monitored", and you "may be required at any time to complete a KYC program" to keep using the service. The privacy policy names the machinery: TRM Labs, Castle.io and SEON for transaction monitoring, Sumsub for identity, Google, Microsoft and Mixpanel for analytics, and Anthropic's Claude for AML screening. Collected fields include your IP address, your wallet address and your wallet provider. AML records are kept a minimum of five years and tax records seven, regardless of any deletion request.

Monero is not accepted, which matters more here than the absence of any single asset usually would: the privacy of a Bitrefill purchase rests entirely on the chain you paid from.

Strengths and limits

The candour is real and it is unusual. Most services in this index publish a threshold and leave the rest to discovery; Bitrefill publishes the thresholds, the corporate entities with registration numbers, and the list of firms that see your data. A reader can price the privacy trade before spending anything.

Then there is the incident. On 1 March 2026 an attacker took a legacy credential from a compromised employee laptop, reached production secrets, and moved through Bitrefill's infrastructure and hot wallets. Bitrefill attributed the breach to the DPRK-linked Lazarus/BlueNoroff cluster and called it the most serious attack in the company's ten-year existence. Roughly 18,500 purchase records were accessed, carrying email addresses, IP addresses and crypto payment addresses; about 1,000 also carried names. Customer balances were untouched, the losses were absorbed from company capital, the site returned on 5 March and a post-mortem followed on 18 March.

The handling was close to textbook. The lesson is the uncomfortable part: the minimum Bitrefill asks for is still enough, once leaked, to link a real inbox and a real IP to a real on-chain address. No KYC and no data are not the same promise. Add geoblocking that can suspend an account if circumvented, no onion service, a closed-source stack and no refunds once a code is unsealed.

Verdict

Bitrefill is the most capable way to turn crypto into ordinary spending without handing over a passport, and it is honest about where that stops. Buy from it as a spender, not as a place to hold value, pay from a chain you are comfortable being seen on, and treat the email you give it as burnable. Grade: C (6.2/10). Trust: CAUTION.