Bitcoin Depot, which operates one of many largest Bitcoin ATM networks, says attackers stole $3.665 million price of Bitcoin from its crypto wallets after breaching its methods final month.
The corporate manages greater than 25,000 Bitcoin ATMs and BDCheckout areas worldwide and reported income of $615 million in 2025.
As revealed in a submitting with the U.S. Securities and Change Fee, the corporate found the assault on March 23 after detecting suspicious exercise on a few of its IT methods.
Whereas it took speedy measures to comprise the breach, the attackers had time to steal credentials to digital asset settlement accounts and switch over 50 Bitcoin from Bitcoin Depot’s wallets earlier than their entry was blocked.
“On March 23, 2026, Bitcoin Depot Inc. (the “Firm”) found that an unauthorized celebration gained entry to sure of its info expertise methods. Upon detection, the Firm promptly activated its incident response protocols, engaged exterior cybersecurity specialists, and notified legislation enforcement,” Bitcoin Depot mentioned.
“Because of this, the unauthorized actor transferred roughly 50.903 Bitcoin from Firm-controlled wallets, valued at roughly $3.665 million as of the date of this report, with out authorization. The Firm additional believes that the incident was contained to the Firm’s company setting and didn’t have an effect on the Firm’s buyer platforms, divisions, methods, information or environments.”
The corporate has additionally notified legislation enforcement of the breach and has employed exterior cybersecurity specialists to assist examine the incident.
Whereas it has insurance coverage protection for cyber-attacks, Bitcoin Depot says that this may not cowl all losses immediately ensuing from the assault.
“On April 6, 2026, the Firm however decided that the incident is materials in gentle of potential penalties of the incident, together with reputations hurt, authorized, regulatory and response prices,” it added.
“The Firm maintains insurance coverage protection that will cowl sure losses related to cybersecurity incidents, however there will be no assurance that such protection will probably be adequate to recuperate all or any losses incurred because of this incident.”
Final 12 months, Bitcoin Depot additionally notified practically 26,000 individuals of a 2024 information breach, stemming from an assault by which risk actors breached its methods to steal the affected people’ private info (i.e., full names, addresses, dates of delivery, driver’s license numbers, electronic mail addresses, and telephone numbers).
In December 2024, U.S. Bitcoin ATM operator Byte Federal disclosed the same incident that resulted in a knowledge breach affecting 58,000 prospects.
Automated pentesting proves the trail exists. BAS proves whether or not your controls cease it. Most groups run one with out the opposite.
This whitepaper maps six validation surfaces, reveals the place protection ends, and offers practitioners with three diagnostic questions for any instrument analysis.
