Crypto ATM operator Bitcoin Depot has disclosed that a hacker stole 50.9 BTC, worth roughly $3.7 million, after gaining unauthorized access to internal systems tied to its corporate wallets.
The breach occurred on March 23, when the attacker took control of credentials linked to Bitcoin Depot’s corporate bitcoin wallets, according to a filing with the US Securities and Exchange Commission.
The company said customer accounts, platforms, and personal data were not affected.
Impact on operations
Bitcoin Depot said the attack has not had a major impact on daily operations and noted it carries insurance that may cover some of the losses.
The filing stated:
“As the investigation of the incident is ongoing, the full scope, nature and impact of the incident are not yet completely known.”
Despite the news, shares of Bitcoin Depot jumped 15.61% on Wednesday, closing at $2.74, with pre-market trading pushing the price to $2.90, a further 5.84% gain.
Mounting legal and regulatory pressure
The theft adds to a difficult stretch for the company.
Bitcoin Depot recently had its money transmission license suspended in Connecticut, along with a temporary cease-and-desist order, with regulators citing high fees and failure to fully refund scam victims.
The company also faces a lawsuit from Massachusetts alleging overcharging and facilitating scams, and paid $1.9 million in Maine to compensate affected users.
In June 2024, Bitcoin Depot suffered a separate data breach that exposed the personal information of 26,732 customers, linked to an external system.
Cities moving to ban crypto ATMs
Bitcoin Depot’s troubles come as US cities are ramping up pressure on crypto ATM operators over fraud concerns.
Stillwater, Minnesota, banned crypto ATMs after residents lost large sums to scams, while Spokane, Washington, introduced a citywide ban in June, calling the kiosks a “preferred tool for scammers.”
Haverhill, Massachusetts, is also considering a ban, with a proposed ordinance citing fraud and money-laundering risks that would require all machines removed within 60 days if approved.
