Malwarebytes has documented a group of websites impersonating Bitrefill's checkout to divert cryptocurrency from people trying to buy gift cards.

In a September 15 investigation [S01], researcher Stefan Dasic described lookalike domains that copied the retailer's branding and purchase flow. The examined checkout offered payments of up to $1,990, then displayed a cryptocurrency address, QR code and countdown timer.

The money was directed to addresses controlled by scammers. The report concerns unaffiliated imitation sites, rather than a disclosed intrusion into Bitrefill accounts or systems.

Bitrefill's own storefront [S02] sells digital gift cards, prepaid payment cards, mobile refills and eSIMs. Its normal gift-card purchase process accepts cryptocurrency and delivers a redemption code, helping explain why that payment method can appear plausible in a copied checkout.

Malwarebytes found variants that changed letters in the brand name or added payment-related wording. Some used internationalized domain names with visually similar characters. It also observed commercial analytics software and a link parameter referring to a search engine, evidence it said pointed to traffic tracking.

The report published domain indicators but did not establish total victim losses, transaction volumes or the campaign's starting date. The $1,990 figure describes the examined checkout's payment ceiling, not a measured loss.