Cybersecurity Attack Costs Bitcoin Depot $3.7 Million in Stolen Cryptocurrency
In a recent SEC filing, Bitcoin Depot reported that cybercriminals successfully extracted 50.9 BTC, valued at approximately $3.7 million, following unauthorized access to the company's internal wallet systems.
The cryptocurrency ATM provider Bitcoin Depot has disclosed a security incident resulting in the theft of approximately 50.9 Bitcoin, valued at around $3.7 million, following unauthorized access to certain internal company systems by a cybercriminal.
According to documentation submitted to the US Securities and Exchange Commission on Monday, the security compromise occurred on March 23 when an unauthorized party successfully obtained control of login credentials associated with Bitcoin Depot's corporate Bitcoin (BTC) storage wallets. The organization emphasized that the incident did not compromise customer accounts, service platforms, or any personal information belonging to users.
The company further indicated that the cybersecurity incident has not significantly disrupted its day-to-day business activities, and noted that it maintains insurance coverage that could potentially offset a portion of the financial losses. "As the investigation of the incident is ongoing, the full scope, nature and impact of the incident are not yet completely known," the filing states.
Bitcoin Depot's stock experienced a notable surge on Wednesday, ending the trading session at $2.74, reflecting an increase of $0.37 or 15.61% for the day, with pre-market trading on Thursday showing continued momentum as the stock reached $2.90, representing an additional 5.84% gain, based on information from Yahoo! Finance.
Bitcoin Depot under pressure
The company has encountered mounting legal challenges and regulatory scrutiny throughout multiple jurisdictions in the United States. Most recently, Connecticut regulators moved to suspend Bitcoin Depot's money transmission license and issued a temporary cease-and-desist order, pointing to infractions including excessive transaction fees and inadequate reimbursement procedures for fraud victims.
Additionally, the organization is contending with legal action initiated by Massachusetts authorities, which accuses the company of overcharging customers and enabling fraudulent activities, and has already agreed to a $1.9 million settlement in Maine to provide restitution to impacted consumers.
During June 2024, Bitcoin Depot also suffered a separate data security incident that compromised the personal details of 26,732 individuals who used the service. The compromise was attributed to a vulnerability in a third-party system, and regulatory bodies authorized the company to proceed with customer notifications only after completing their investigation in June 2025.
US cities move to ban crypto ATMs
Municipal governments throughout the United States are intensifying their crackdown on cryptocurrency ATM installations amid rising fraud concerns. Following substantial financial losses suffered by local residents through scam operations, Stillwater, Minnesota, has implemented a complete prohibition on crypto ATMs, while Spokane, Washington, enacted a comprehensive citywide ban in June, characterizing these kiosks as a "preferred tool for scammers" in response to an escalation in fraudulent activity.
Meanwhile, Haverhill, Massachusetts, is actively deliberating a similar prohibition on crypto ATM machines, with a draft ordinance highlighting concerns about fraudulent schemes and money laundering threats that would mandate the removal of all existing machines within a 60-day period should the measure receive approval.