Vouchers and ATMs

Bitrefill review

Bitrefill, operated by Airfill Prepaid AB in Sweden, offers gift cards and phone top-ups for cryptocurrency, including bitcoin over Lightning. Purchases can be made without creating an account, requiring only an email or phone number for delivery, with daily limits set at 500 USD and monthly limits at 1,000 USD. Above the account limits, Bitrefill will request verification through SumSub, which involves providing a photo ID, proof of address, and a live selfie. Usage is monitored, and KYC may be required at any time to continue using the service. In our view, Bitrefill suits small purchases that stay under the guest limits.

ID only if flagged

Bitrefill asks for ID only if a payment is flagged, per its own pages.

ActiveNo account

By Ethan ParkerChecked Oct 22, 2026 to Oct 23, 2026How we read the terms

ID if flaggedNo account neededID rule: If a payment is flagged. No ID by default; checks when a risk system flags you. Checked Oct 22, 2026.
5,000 USDNo-ID limit per tradeNo-ID limits, per Bitrefill's pages: 500 USD a day, purchases without account. Checked Oct 22, 2026.
LNCoinsLightning: supported.
Not statedBitrefill's own pages we checked do not say, checked Oct 14, 2026. This is not the same as no.Who holds your coinsCustodial only for the optional Store Credit balance (capped at 2,000 USD); otherwise each purchase is paid per invoice and the product is delivered as a code. Checked Oct 22, 2026.
Not statedBitrefill's own pages we checked do not say. This is not the same as no.NetworkTor onion: None published. I2P: None published. Works without JavaScript: Not stated.
Our verdict

Choose Bitrefill if

Who Bitrefill suits, from the values on this page.

Bitrefill suits you if

  • You want no ID for normal use: Bitrefill asks only if a payment is flagged.
  • You want to pay or get paid over Lightning.

Bitrefill might not be the right fit if

  • You want a market that can never ask for ID: Bitrefill can ask if a payment is flagged.
  • You want Monero: Bitrefill does not list it.
  • You want a service with no incident on record: Bitrefill had one in 2026.
kycnot.me

What kycnot.me says about Bitrefill

kycnot.me is an independent directory of services you can use without ID checks. The rating and notes below are its own, not ours.

KYC level
Level 3: Shotgun KYC

An ID check or a hold on funds can come up during a transaction, usually through anti-money-laundering screening, limits or partner rules. kycnot.me sorts services into five levels, from 0 (never asks for ID) to 4 (ID is mandatory).

kycnot.me score
4 out of 10 Privacy 37 out of 100, trust 55 out of 100
Listing status
Verified
Accepts as payment
BitcoinLightningFiat money

Not accepted: Monero, Cash.

Pros kycnot.me lists

  • Identity-Free registration
  • No registration needed
  • Good Customer Support
  • Legally registered

Cons kycnot.me lists

  • May require KYC/SOF by policy/law
  • Refunds may require KYC
  • May suspend your account
  • Data Sharing
  • Transaction monitoring
  • Source code is private

Also noted: Email required, JavaScript needed, Some countries are restricted

Source: the kycnot.me listing. Bitrefill on kycnot.me (opens in a new tab)

Checked October 22, 2026

Platform

Inside Bitrefill

What you get with Bitrefill

Yes, no or partly, from our data

Privacy 1 of 6, 1 partly

  • No IDPartlyIf a payment is flagged
  • No accountYes
  • Tor built inNot statedNot statedBitrefill's own pages we checked do not say. This is not the same as no.
  • Onion addressNoNone published
  • I2P addressNoNone published
  • Works without JavaScriptNot statedNot statedBitrefill's own pages we checked do not say. This is not the same as no.

Coins 1 of 4

  • BitcoinNot statedNot statedBitrefill's own pages we checked do not say. This is not the same as no.
  • MoneroNo
  • LightningYes
  • ZcashNo

Custody and code 0 of 3

  • You hold the keysNot statedNot statedBitrefill's own pages we checked do not say, checked Oct 14, 2026. This is not the same as no.
  • Open sourceNot statedNot statedBitrefill's own pages we checked do not say, checked Oct 14, 2026. This is not the same as no.
  • Address screeningNot statedNot statedBitrefill's own pages we checked do not say. This is not the same as no.
ID check

When can Bitrefill ask for your ID?

If a payment is flagged, per Bitrefill's own pages. Labels come from each provider's terms, never from our guess.

  1. 1Never, by designNo company holds your order, so nobody can ask
  2. 2Only if you chooseID only for extras you opt into
  3. 3If a payment is flaggedBitrefill is on this stepNo ID by default; checks when a risk system flags you
  4. 4Above a limitID once you pass a stated amount
  5. 5AlwaysID before you trade, deposit or withdraw

If a check comes and you do not pass it

Store Credit beyond the limit: account frozen until KYC is completed; excess balances are refunded only after mandatory identity verification and refusal can freeze the account and remaining credit; circumventing limits with several accounts leads to suspension until due diligence is completed

“In case of balances exceeding the applicable limit a refund will be issued to a Customer upon mandatory identity verification of the account holder. Refusal to conduct verification may lead to Bitrefill freezing the account and any remaining credit until such verification is completed.”

What triggers a check: Purchases above the limits of the account level (no account: 500 USD per day, 1,000 USD per month; basic account: 5,000 USD per day, 10,000 USD per month); Store Credit above 2,000 USD or added in violation of the thresholds; products reserved for verified accounts (e.g. some bill payment products); continuous monitoring and suspicious transactions (KYC can be required at any time); using more than one account to circumvent limits

Not stated on Bitrefill's pages: fee on refusal, refund policyBitrefill's own pages we checked do not say. This is not the same as no.

Checked October 22, 2026

Fees and limits

What Bitrefill costs

WhatBitrefill
Trade feeService fee may be charged, disclosed at checkout before payment; payments may carry network fees and confirmation times; refunds of BTC Store Credit carry a processing fee
No-ID limitWithout account: 500 USD per day, 1,000 USD per month, 15 items and 2 phone items per day; with an unverified email account: up to 5,000 USD per day and 10,000 USD per month

Checked October 22, 2026

Your data

What Bitrefill knows about you

Who sees what during a trade, and who runs it.

During a trade

Data the policy collects
Collects device, browser and app data including IP address; guest purchases are grouped into an internal guest profile with checkout email, IP, geolocation and device data; KYC data shared with SumSub (SumSub stores the biometric selfie); analytics with Microsoft and Mixpanel; compliance data kept at least 5 years, tax data at least 7 years; assistant chats 30 days
What your payment reveals

No ID check does not make a bank payment private.

Network and who runs it

Network
Onion: None publishedI2P: None publishedWithout JavaScript: Not statedBitrefill's own pages we checked do not say. This is not the same as no.
Who runs it
Operator: Airfill Prepaid AB, Sweden (registration number 559001-6035)
Requests from authorities
Data may be shared to comply with court orders and law enforcement requests, including subpoenas
Warrant canary
Not published

Checked October 22, 2026

Safety

Track record and code

One security incident in March 2026 with exposure of customer purchase data; no seizure, closure or regulator action found.

Incidents

  1. 2026Mar 19, 2026: Per Bitrefill's statement as reported by BleepingComputer: attack via a compromised employee laptop, likely by the DPRK Lazarus/Bluenoroff group; about 18,500 purchase records with email addresses, IP addresses and crypto payment addresses exposed, names for 1,000 purchases; parts of the database and some crypto wallets accessed; losses covered from Bitrefill's capital.
  2. 2026Mar 1, 2026: Security issue detected, services taken offline; Bitrefill stated all user balances were safe and unaffected.
Open source
Not statedBitrefill's own pages we checked do not say, checked Oct 14, 2026. This is not the same as no.
Support
E-mail [email protected]

Checked October 22, 2026

Reddit

Community

Discussions about Bitrefill on Reddit (opens in a new tab) (r/Bitrefill)

More facts

More facts we checked on Bitrefill

Onion address
Not published
I2P address
Not published
Where you live

Bitrefill in the US and elsewhere

In the US

US availability: Available

If you are a US person, US sanctions rules apply to you whether or not a service asks for ID.

Outside the US

Excluded countries: Persons subject to sanctions of the European Union, the United States or the United Kingdom and sanctioned territories; individual products are geo-limited by country

Regional rule: Not statedBitrefill's own pages we checked do not say. This is not the same as no.

Site blocks by region
Persons subject to sanctions of the European Union, the United States or the United Kingdom and sanctioned territories; individual products are geo-limited by country

Where you live and the provider's terms

Many services on this page do not serve every country. Some exclude people because of where they live or their citizenship, not only where they connect from. Read the provider's terms before you send funds. If the terms exclude you, do not use the service, and do not try to get around the restriction, for example with a VPN.

Taxes

A service that does not ask for ID does not change your taxes. In the US, the federal income tax return asks a yes-or-no question about digital assets, and you must report digital asset transactions whether or not they result in a gain or loss. In the UK, you may owe Capital Gains Tax when you sell, swap or spend crypto, and you must keep your own records. Rules in other countries differ.

No KYC is not anonymity

"No KYC" here means the provider says it does not ask for ID in the cases its terms describe. It does not make you anonymous. Bitrefill's terms say it can ask for ID in these cases: Purchases above the limits of the account level (no account: 500 USD per day, 1,000 USD per month; basic account: 5,000 USD per day, 10,000 USD per month); Store Credit above 2,000 USD or added in violation of the thresholds; products reserved for verified accounts (e.g. some bill payment products); continuous monitoring and suspicious transactions (KYC can be required at any time); using more than one account to circumvent limits. Regulated exchanges you send funds from or to may have to collect information about who sends and who receives a crypto transfer. Your tax duties stay the same.

Funds can be held

If a provider asks for more information during a swap or a withdrawal, it may hold your funds until it gets it. Its terms decide what happens next. In the UK, a crypto business that asks for information on a transfer to or from a self-custody wallet, and does not receive it, must not pass the funds on. Read what the provider's terms say before you send. Bitrefill's terms say that if a check is requested and not completed: store Credit beyond the limit: account frozen until KYC is completed; excess balances are refunded only after mandatory identity verification and refusal can freeze the account and remaining credit; circumventing limits with several accounts leads to suspension until due diligence is completed.

Checked October 22, 2026

Alternatives

Vouchers and ATMs to compare with Bitrefill

Other active services in this category from our list. The shield shows each one's ID rule from its own terms.

Azteco Lightning ID rule: If a payment is flagged. No ID by default; checks when a risk system flags you.
Bitcoin ATMs (US kiosks) ID rule: Above a limit. ID once you pass a stated amount.

Bitrefill side by side

From our privacy data, the same fields for every service
WhatBitrefillAztecoBitcoin ATMs (US kiosks)Stealths
ID ruleID only if flaggedID only if flaggedID above a limitNot stated
AccountNoneNoneNot statedNot stated
You hold the keysNot statedNoNot statedNot stated
MoneroNoNoNot statedNot stated
LightningYesYesNot statedNot stated
Open sourceNot statedNot statedNot statedNot stated

Checked October 22, 2026

FAQ

Short answers about Bitrefill

From the data on this page.

Does Bitrefill ask for ID?

Bitrefill asks for ID only if a payment is flagged, per its own pages. There is no account.

How much can you trade on Bitrefill without ID?

500 USD a day, purchases without account.

Can you buy Monero on Bitrefill?

No. Bitrefill does not list Monero, per its own pages.

What does Bitrefill cost?

Trade fee: Service fee may be charged, disclosed at checkout before payment; payments may carry network fees and confirmation times; refunds of BTC Store Credit carry a processing fee.

Author

Who checked this page

Ethan Parker

Senior Content Editor

Every value on this page comes from Bitrefill's own pages and code, read on the dates shown. The kycnot.me section is the exception: it shows kycnot.me's own rating. Checked Oct 22, 2026 to Oct 23, 2026.

Sources

Sources, how we read the terms and our process

Sources

  1. bitrefill.com, for I2P address, checked October 22, 2026
  2. bitrefill.com/privacy, for data collected, checked October 22, 2026
  3. bitrefill.com/terms, for ID rule, what triggers a check, no-ID limit, what happens if a check fails, custody in detail, account, onion address, operator, excluded countries, US availability, fees, requests from authorities, warrant canary, support and site blocks by region, checked October 22, 2026
  4. bitrefill.com/terms, for status, checked October 23, 2026
  5. bleepingcomputer.com/news/security/bitrefill-blames-north-korean-lazarus-group-for-cyberattack, for incidents, checked October 22, 2026
  6. help.bitrefill.com/hc/en-us/articles/4613768372882-What-cryptocurrencies-are-accepted-by-Bitrefill, for Monero and Lightning, checked October 22, 2026
  7. help.bitrefill.com/hc/en-us/articles/4613768372882-What-tokens-are-accepted-by-Bitrefill, for Zcash, checked October 22, 2026
  8. kycnot.me/service/bitrefill, for kycnot.me rating, checked October 22, 2026
  9. x.com/bitrefill/status/2028229208439206150, for incidents, checked October 22, 2026

How we read the terms

We do not give privacy services a score. We record what each provider's own pages say: when it asks for ID, the limits, who holds your coins and what it costs. Labels come from each provider's terms, never from our guess. How we read the terms

Our process

We take fees, availability, licenses and coin counts from primary sources: Bitrefill's own fee schedules, terms and help pages, and the public registers kept by regulators. Every value carries the date we last checked it. The values on this page were checked between October 22, 2026 and October 23, 2026.