Bitcoin ATM operator Bitcoin Depot said hackers stole 50.9 BTC, worth about $3.665 million, after breaching company systems on March 23. The company disclosed the incident in a Wednesday SEC filing and said attackers used stolen credentials for digital asset settlement accounts to move funds. Bitcoin Depot said the breach did not affect customer-facing platforms or user data, though it classified the event as material due to potential legal and reputational costs.
What does a breach at a major Bitcoin ATM operator mean for trust in crypto on-ramps?
Bitcoin Depot said the attackers gained access to its IT systems and then obtained credentials tied to settlement accounts. From there, they transferred the Bitcoin without authorization. The company valued the lost holdings at $3.665 million at the time of the theft.
After discovering the breach, Bitcoin Depot said it activated incident response protocols and brought in outside cybersecurity experts. The company said those experts are investigating the attack path and helping secure the remaining assets. It also notified law enforcement, though the filing did not name the agencies involved.
At the same time, the company said the financial impact has stayed relatively contained so far. Still, it recorded a preliminary loss of $3.665 million and said insurance may cover part of the damage. The filing did not say whether Bitcoin Depot carries specific insurance for digital asset theft.
Bitcoin Depot operates one of the largest Bitcoin ATM networks, making it a key access point for retail crypto users. That role places the company close to customer flows, transaction processing, and sensitive custody functions. In turn, the source text says infrastructure providers like this remain attractive targets for attackers.
The disclosure also pointed to broader risks around the crypto service chain. Firms in this segment hold keys, process transactions, and connect users to the network. Because of that setup, security incidents can affect how users and investors judge trust in crypto on-ramps.
For now, Bitcoin Depot said the incident has not materially disrupted operations. Even so, it is called the breach material because of possible legal, regulatory, response, and reputational costs. The filing also did not say how the loss could affect Bitcoin liquidity across its ATM network.
Read More: Bitcoin Price at $70K: Strong Support Builds as Market Eyes $80K
This is at least the second known security incident involving Bitcoin Depot. In 2023, hackers accessed personal data tied to 58,000 users. More recently, the company also adopted stricter identity verification rules for all ATM transactions as regulators increased oversight of Bitcoin ATM operations.
The source text says Bitcoin Depot had not issued a public statement beyond the SEC filing at the time of writing. Decrypt contacted a company spokesperson for comment but did not receive an immediate response. That left the filing as the company’s main public account of the breach.
Meanwhile, Bitcoin Depot shares rose 15% during the trading day and closed at $2.74. After the SEC disclosure, the stock moved lower in after-hours trading. Over the last 30 days, the shares have fallen 44%.
Bitcoin Depot disclosed that hackers stole 50.9 BTC worth $3.665 million after breaching its internal systems and settlement account credentials. The company said customer platforms and user data remained unaffected. The case shows why security remains critical for crypto infrastructure providers as trust and regulatory scrutiny continue to grow.