Bitcoin Depot, the largest Bitcoin ATM operator in the US, announced a hack of its corporate infrastructure. Attackers stole credentials for payment accounts and withdrew approximately 50.9 BTC (approximately $3.665 million at the exchange rate at the time of the incident) from the company's wallets.
The hack was discovered on March 23, 2026, when the company's security team detected suspicious activity. Bitcoin Depot immediately initiated incident response procedures, engaged third-party security specialists, and notified law enforcement. However, by this time, the attackers had already gained access to payment account credentials and transferred the cryptocurrency to wallets under their control.
The incident was officially disclosed this week, following the publication of a notice the company filed with the US Securities and Exchange Commission (SEC). Bitcoin Depot representatives emphasize that the incident only affected the corporate environment and did not affect client platforms, user data, or the operation of the ATM network.
Bitcoin Depot is the largest Bitcoin ATM operator in the United States. The company operates a network of more than 25,000 BDCheckout devices and locations worldwide; revenue for 2025 was $615 million.
This is the second major security incident at Bitcoin Depot in the past year. In the summer of 2025, the company notified nearly 27,000 people about a data breach: at that time, attackers accessed files containing clients' personal data (names, addresses, dates of birth, driver's license numbers, email addresses, and phone numbers).
However, notification of the breach was delayed for almost a year (the hack was discovered on June 23, 2024) due to an ongoing law enforcement investigation.
The hack was discovered on March 23, 2026, when the company's security team detected suspicious activity. Bitcoin Depot immediately initiated incident response procedures, engaged third-party security specialists, and notified law enforcement. However, by this time, the attackers had already gained access to payment account credentials and transferred the cryptocurrency to wallets under their control.
The incident was officially disclosed this week, following the publication of a notice the company filed with the US Securities and Exchange Commission (SEC). Bitcoin Depot representatives emphasize that the incident only affected the corporate environment and did not affect client platforms, user data, or the operation of the ATM network.
Bitcoin Depot is the largest Bitcoin ATM operator in the United States. The company operates a network of more than 25,000 BDCheckout devices and locations worldwide; revenue for 2025 was $615 million.
This is the second major security incident at Bitcoin Depot in the past year. In the summer of 2025, the company notified nearly 27,000 people about a data breach: at that time, attackers accessed files containing clients' personal data (names, addresses, dates of birth, driver's license numbers, email addresses, and phone numbers).
However, notification of the breach was delayed for almost a year (the hack was discovered on June 23, 2024) due to an ongoing law enforcement investigation.