Bitrefill review: legitimate, capable, and not without scars

Our verdict

Bitrefill is legitimate. Not "probably fine" — verifiably legitimate, with a named Swedish trading entity, a company registration number you can look up, terms of service governed by Swedish law, and eleven years of continuous operation. In a category littered with anonymous shops that vanish after a good quarter, that alone puts it in the top tier.

The service does what it claims. Codes arrive in seconds. Lightning payments settle for pennies. You can buy without handing over a passport. The Trustpilot record (4.6/5 across 2,800+ reviews) is genuinely strong and, importantly, the negative reviews almost never dispute delivery.

Two things stop this being a straightforward recommendation. First, pricing is opaque by design: Bitrefill charges no visible fee, but embeds its margin in the listed price, and that margin ranged from effectively zero on Amazon cards to 13.7% on a $200 Steam card on the day we checked. Second, the March 2026 breach was serious — roughly 18,500 purchase records exposed, hot wallets drained, attributed to a state-linked group.

Our score: 4 out of 5. Use it, but compare the listed price to face value every time, use a dedicated email address, and redeem codes rather than hoarding them.

Who you are actually dealing with

Start here, because it is the question the "is Bitrefill legit" searches are really asking, and it has a documentary answer rather than an opinion.

Bitrefill launched in 2014 out of Stockholm, Sweden. Sergej Kotliar is co-founder and CEO, and unlike much of this industry he has been publicly identifiable and vocal on Bitcoin payments for a decade — which matters, because reputational skin in the game is a form of security. The trading entity behind gift cards and phone refills is Airfill Prepaid AB, Swedish company number 559001-6035. Bill payments outside El Salvador run through Airfill US LLC, Delaware file 5817333. The terms of service place disputes exclusively under Swedish law and in Swedish courts.

All of that is checkable. Swedish company records are public through Bolagsverket, and Sweden's financial regulator, Finansinspektionen, publishes its registers openly. Do the lookup yourself if you want; it takes two minutes and it is the difference between trusting a brand and verifying a company.

What the reviews really say, once you read past the score

A 4.6/5 average across 2,800+ reviews is a strong number, and the distribution is heavily concentrated in five-star ratings. Scores like that are easy to wave at and hard to learn from, so we read the negatives instead. They cluster into four groups, and the composition is revealing.

Price complaints are the largest group. Not "I was charged a fee" — Bitrefill genuinely does not add one on most gift cards — but "the card cost more than it is worth". These are people discovering the embedded markup after the fact. Every one of them was avoidable by looking at the number before paying, and none of them were caused by anything dishonest. They were caused by a UI that does not show face value next to price.

Region-lock complaints come next: a card bought for the wrong storefront, unredeemable, and not refundable because the code has been revealed. Bitrefill states the region restriction on every product page, so these are user errors — but they are predictable user errors, and the volume of them is a design signal.

Failed orders during volatility form a third group. The checkout locks a quote for a short window; if your transaction confirms slowly or the price moves, the order can fail. It is recoverable through support, but it costs an email and a wait, and people write reviews about waits.

Frozen and flagged transactions are the fourth and smallest, but the most consequential when they happen: an automated risk system holds an order and the resolution path runs through identity verification.

What is almost entirely absent is the complaint that would actually indicate a scam: "I paid and got nothing, and nobody answered." For a business processing crypto payments at this volume since 2014, that absence is the most informative thing in the dataset.

The March 2026 security incident, in full

This is the part most Bitrefill reviews skip or bury, so here it is with dates and numbers. It matters to your decision, and pretending otherwise would make this page worthless.

On 1 March 2026, attackers compromised an employee laptop. From there they reached legacy credentials, then production systems, and drained funds from Bitrefill's hot wallets. Bitrefill disclosed the incident publicly on 17 March 2026 and attributed it to the North Korea-linked Lazarus Group, citing the malware used, on-chain tracing, and reused IP and email addresses as the basis for that attribution.

How should you weigh this? Three observations, and we will be straight about which are facts and which are judgement.

Fact: the data lost was thin, and that is a direct consequence of not doing blanket KYC. An exchange breached the same way loses passports, addresses and dates of birth. Bitrefill lost emails, payment addresses and IPs, because that is close to everything it holds on a typical customer. The privacy-light model that makes some people suspicious of the platform is precisely what limited the damage.

Fact: it disclosed, attributed, and committed to covering losses. Sixteen days from incident to public report, with a named suspected actor and a technical basis for the attribution. Compare that to the industry norm of a vague "security event" notice months later.

Judgement: the exposure still has a long tail. An email address paired with a crypto payment address and a purchase history is excellent raw material for targeted phishing. If you used Bitrefill before March 2026 and you have since received unusually well-informed "Bitrefill support" emails, that is why. Nothing about the platform's current security posture changes the fact that this list exists somewhere.

The terms that catch people out

Bitrefill's terms of service are unusually readable and contain actual numbers, which is to their credit. They also contain four clauses that generate most of the disappointment, and none of them are hidden.

Refunds are narrow. Failed transactions, invalid products, already-redeemed codes. That is the list. Once a product is unsealed there are no refunds outside those cases, and requests must land within 30 days. After that, any refund is discretionary and issued as a gift card rather than back to your wallet.

Inactivity freezes balances. Sealed products and store credit freeze after 12 months of non-use. Bitrefill will unfreeze "to the extent commercially feasible" — a phrase that is doing considerable work and should be read as a favour, not a right.

Circumventing geoblocking is prohibited. Explicitly. So is reselling products and running multiple accounts to evade limits. The stated consequences are account suspension and, in the terms' own language, seizure of assets. People reach for a VPN to make a mismatched card work and turn a €50 mistake into a locked account.

KYC can be demanded at any time. The tiered limits are real — $500/day and $1,000/month unverified, rising through basic and verified tiers — but the terms also reserve the right to require verification whenever automated monitoring flags something. Full breakdown on our KYC and limits page.

What using it is actually like

The mechanics are better than the category average, and the friction is concentrated in two places.

Delivery genuinely is instant. Not "instant" in the marketing sense — the code renders on the confirmation screen while the email is still arriving. For eSIMs you get a QR code the same way. This is the strongest part of the product and it is why the Trustpilot score is what it is.

Payment is where the skill is. Bitrefill accepts a decent spread of assets and networks, and the difference between choosing well and choosing badly is measured in real money. Paying $10 with on-chain Bitcoin during a congested hour can add several dollars in miner fees that Bitrefill never receives and cannot refund. Lightning, Litecoin, or a stablecoin on a cheap network settles for pennies. Our payment methods comparison lays out which to use when.

Support is human but not instant. Bitrefill advertises 24/7 support on product pages and in practice responds, but a failed order is a day-scale problem rather than a minutes-scale one. Budget for that if you are buying something time-sensitive.

Who should use Bitrefill, and who should not

Use it if you are paid in crypto and want to skip the exchange-to-bank loop; if you live somewhere card payments to foreign merchants are unreliable; if you want a hard spending ceiling on a subscription or a gaming budget; or if you travel and want data without carrier roaming fees, where the eSIM catalogue is genuinely excellent.

Do not use it if you are hoping to save money. A gift card bought with crypto is priced at par at best and at a double-digit premium at worst. There is no version of this where routing your groceries through Bitcoin makes them cheaper.

Look elsewhere if Monero is non-negotiable, or if you need deep local catalogues in Latin America, Africa or parts of Asia — Coinsbee and CryptoRefills each beat Bitrefill on specific axes, and we say exactly where on the alternatives page.

One last note on the searches that brought some readers here. Queries like "Bitrefill carding method" and "free Bitrefill gift card codes" describe fraud, not a technique. They are covered by the prohibited-use clause, they end in suspended accounts and seized balances, and the pages promising them are phishing. If your interest in this platform is legitimate — spending your own crypto efficiently — the highest-value page on this site is not this review. It is the fees and markups breakdown, because that is where the money actually is.

Frequently asked questions

Is Bitrefill legit?

Yes, in the sense that matters: it is a registered Swedish company (Airfill Prepaid AB, company number 559001-6035) that has been trading since 2014, publishes named terms of service governed by Swedish law, and holds a 4.6/5 Trustpilot score across 2,800+ reviews. You can verify the company yourself at Bolagsverket, the Swedish Companies Registration Office. That is a far stronger footing than the anonymous voucher shops this category is full of.

Is Bitrefill safe to use after the 2026 hack?

The incident was real and Bitrefill disclosed it. On 1 March 2026 attackers compromised an employee laptop, reached production systems, drained hot wallets and exposed roughly 18,500 purchase records — email addresses, crypto payment addresses and IP addresses. Bitrefill attributed it to the North Korea-linked Lazarus Group and said it would cover losses from operational capital. No passwords or payment card data were reported as taken, and services were restored. Our read: the platform handled disclosure better than most, but the exposure is a reason to use a dedicated email address and to redeem codes promptly rather than storing them.

What does Bitrefill's Trustpilot score actually tell you?

4.6/5 from 2,800+ reviews is genuinely good for a payments business, and the distribution is heavily weighted to five stars. Read the negatives and a clear pattern emerges: almost none dispute that the product arrived. They dispute price, region locks and failed orders during volatile pricing. That is a useful signal — the delivery works, the expectations management does not.

Does Bitrefill report to tax authorities?

Bitrefill is a merchant, not a broker, and it does not issue tax forms the way an exchange does. That does not make your purchases invisible or tax-free: in most jurisdictions, spending appreciated crypto is a disposal and may be a taxable event regardless of what the merchant reports. Under the EU's DAC8 framework, reporting obligations across crypto services are broadening. Check your own position with a local professional — we are not qualified to advise on it and this page is not tax advice.

Is Bitrefill anonymous?

Partially, and less than the marketing implies. Small purchases work with just an email address and no identity documents, which is genuinely more private than most alternatives. But Bitrefill records your email, your payment address and your IP — which is precisely the set exposed in the 1 March 2026 breach — and the terms reserve the right to demand KYC at any time. It is low-friction, not anonymous. Details on the KYC page.

What happens if my order fails?

Bitrefill's refund policy covers exactly three situations: failed transactions, invalid products, and codes that were already redeemed. Requests must be made within 30 days; after that, refunds are at Bitrefill's discretion and issued as gift cards. Once a product is unsealed — meaning you have revealed the code — there are no refunds outside those cases. Buyer's remorse is not covered.

Who owns Bitrefill and where is it based?

Bitrefill was founded in 2014 and is headquartered in Stockholm, Sweden. Sergej Kotliar is co-founder and CEO and remains one of the more visible people in Bitcoin payments. The gift card and phone top-up business trades as Airfill Prepaid AB; a separate Airfill US LLC (Delaware file 5817333) handles bill payments outside El Salvador.

Is Bitrefill better than its alternatives?

For Lightning payments, catalogue depth in Europe and North America, and delivery reliability — yes, it is the benchmark. For altcoin variety it loses to Coinsbee, which supports 60+ assets including Monero. For utility bills and mobile refills in Latin America and Africa, CryptoRefills is often the specialist. We compare them properly on the alternatives page.

Sources and further reading

• CoinDesk — Bitrefill blames Lazarus for compromising 18,500 purchase records
• Bitrefill — Terms of service (limits, refunds, freezing, prohibited use)
• Trustpilot — Bitrefill reviews
• Bolagsverket — Swedish Companies Registration Office
• Finansinspektionen — Swedish Financial Supervisory Authority
• EUR-Lex — Regulation (EU) 2023/1114 (MiCA) full text

Keep reading

Closely related guides on this site:

KYC, limits and what stays privateThe markups the reviews complain aboutAlternatives, compared properlyWhat Bitrefill accepts — and no longer accepts

Updated: August 12, 2026 · Independent editorial — we are not Bitrefill.