Crypto ATM operator Bitcoin Depot revealed that it lost about 50.9 Bitcoin, worth roughly $3.7 million, after a hacker gained access to some of its internal systems.
The breach happened on March 23 after the attacker took control of credentials linked to Bitcoin Depot’s corporate Bitcoin (BTC) wallets, according to a Monday filing with the US Securities and Exchange Commission. The company said that customer accounts, platforms and personal data were not affected.
Bitcoin Depot added that the attack has not had a major impact on daily operations, and said it has insurance that may cover some of the losses. “As the investigation of the incident is ongoing, the full scope, nature and impact of the incident are not yet completely known,” the filing states.
Shares of Bitcoin Depot jumped sharply on Wednesday, closing at $2.74, up $0.37 or 15.61% on the day, with additional gains in pre-market trading pushing the price to $2.90, a further 5.84% increase, according to data by Yahoo! Finance.
Related: Bitcoin Depot enters Hong Kong as part of Asia expansion
Bitcoin Depot under pressure
Bitcoin Depot has been facing growing legal and regulatory pressure across several US states. The company recently had its money transmission license suspended in Connecticut, along with a temporary cease-and-desist order, with regulators citing violations such as high fees and failure to fully refund scam victims.
The company has also faced a lawsuit from Massachusetts alleging overcharging and facilitating scams, and paid $1.9 million in Maine to compensate affected users.
The US has more than 30,000 Bitcoin ATMs. Source: CoinATMRadar
In June 2024, Bitcoin Depot also experienced a data breach that exposed the personal information of 26,732 customers. The breach was linked to an external system, and authorities cleared the company to issue notifications only after the probe concluded in June 2025.
Related: Australia’s financial watchdog may gain power to ban crypto ATMs
US cities move to ban crypto ATMs
US cities are increasing pressure on crypto ATMs as concerns over fraud grow. Stillwater, Minnesota, has banned crypto ATMs after residents lost large sums to scams, while Spokane, Washington, introduced a citywide ban in June, calling the kiosks a “preferred tool for scammers” following a spike in fraud cases.
Haverhill, Massachusetts, is also considering banning crypto ATMs, with a proposed ordinance citing fraud and money laundering risks that would require all machines to be removed within 60 days if approved.
Magazine: Bitcoin may take 7 years to upgrade to post-quantum — BIP-360 co-author