Bitrefill disclosed a cyberattack that drained its hot wallets and accessed 18,500 records.