Bitcoin Depot, one of the world's largest bitcoin ATM operators, revealed on April 8 that it lost 50.903 bitcoins — valued at roughly $3.665 million at the time — after a targeted cyberattack late March.
In a Form 8-K filed with the U.S. Securities and Exchange Commission, the company said the breach was first detected on March 23, 2026. An unauthorized party infiltrated internal IT systems, eventually gaining control over credentials for digital asset settlement accounts. The intruder then siphoned 50.903 BTC from company-controlled wallets.
Bitcoin Depot stressed that the attack appeared isolated to its corporate environment. Customer platforms were not affected, and there was no evidence that personally identifiable information was accessed or exfiltrated. The company activated emergency protocols, hired third-party cybersecurity specialists, and notified law enforcement. It is now working to harden infrastructure against future intrusions.
Initially, management did not consider the incident “materially impactful” to daily operations. However, on April 6, after reevaluating, the company deemed the event material due to potential reputational harm, legal and regulatory costs, and response expenses. Bitcoin Depot holds cybersecurity insurance, but there is no guarantee full reimbursement for the $3.665 million loss.
Industry Precedent: Byte Federal's Earlier Data Breach
This is not the first security incident in the bitcoin ATM space. Last year, another major operator, Byte Federal, suffered a data breach potentially affecting 58,000 users. While Bitcoin Depot's loss is direct crypto theft, the regulatory and reputational fallout could be significant.
Bitcoin Depot's stock showed no major movement immediately after the disclosure. Whether the SEC will launch a formal probe remains to be seen.