Bitcoin Depot Inc., a major Bitcoin ATM operator, has disclosed in a filing with the Securities and Exchange Commission that hackers stole approximately 50.9 BTC, valued at $3.665 million, from company-controlled wallets. The breach occurred on March 23, according to the filing submitted Wednesday. The company has not issued a separate public statement on the incident beyond the regulatory disclosure.
The attackers infiltrated Bitcoin Depot’s IT systems and obtained login credentials for digital asset settlement accounts, allowing them to move cryptocurrency without authorization. Following the discovery of the intrusion, the company activated its incident response protocols and brought in external cybersecurity specialists to identify the attack vector and protect remaining assets. Law enforcement authorities were also notified, though the filing did not name the specific agencies involved.
Bitcoin Depot stated that its customer-facing platforms and user data were not affected by the breach. The company classified the incident as material to its operations, citing potential reputational harm as well as anticipated legal, regulatory, and incident response costs. The preliminary loss estimate of $3.665 million reflects the value of Bitcoin at the time the funds were taken.
The SEC filing did not address whether Bitcoin Depot carries insurance coverage for digital asset theft or how the loss could affect liquidity across its ATM machine network. The company’s ability to facilitate cash-to-crypto transactions depends on maintaining sufficient cryptocurrency reserves, a factor that may draw additional scrutiny following the incident.
Bitcoin ATM operators have increasingly become targets for cybercriminals, given the substantial cryptocurrency holdings they must keep on hand to support customer transactions. These businesses face distinct security challenges because they connect physical cash infrastructure with digital custody systems, creating multiple potential points of vulnerability.
This is at least the second known security incident involving Bitcoin Depot. In 2023, a separate breach exposed personal data belonging to approximately 58,000 users. The company has also faced growing regulatory pressure, recently introducing stricter identity verification requirements for all ATM transactions as oversight of Bitcoin ATM operations intensifies.
Shares of Bitcoin Depot, trading under the ticker BTM, rose 15% during Wednesday’s trading session, closing at $2.74, before retreating in after-hours trading following the SEC disclosure. The stock remains down approximately 44% over the past 30 days.
Originally reported by Decrypt.
