Bitcoin Depot, one of the world's largest Bitcoin ATM operators, disclosed on April 8 that it lost over 50 Bitcoin following a targeted cyberattack on March 23. According to a Form 8-K filed with the U.S. Securities and Exchange Commission (SEC), an unauthorized third party breached the company's internal IT systems and gained access to payment account credentials, subsequently withdrawing 50.903 BTC (valued at approximately $3.665 million at the time) from the company's managed wallets.
Incident Details and Response
Upon detecting the breach, Bitcoin Depot activated its emergency response protocols, engaged external cybersecurity experts, and notified law enforcement. The company emphasized that the incident was contained to internal systems and did not affect its customer-facing platforms or user data. While initially stating the event had no “material impact” on operations, management later reclassified it as material on April 6 due to potential reputational, legal, and regulatory consequences, as well as remediation costs.
Insurance and Financial Outlook
Bitcoin Depot holds insurance for cybersecurity incidents but noted there is no guarantee the full $3.665 million loss will be covered. Nevertheless, the company expects no long-term impact on its overall financial condition or its North American Bitcoin ATM network. This attack follows a recent data breach at Byte Federal, another major Bitcoin ATM provider, which affected approximately 58,000 users, highlighting persistent security challenges in crypto infrastructure.