Bitcoin Depot, the operator of the largest Bitcoin ATM network in the U.S., has disclosed a multimillion-dollar cyberattack and a sharp expected revenue decline. The company reported a loss of 50.903 Bitcoin, valued at approximately $3.665 million, due to compromised internal credentials. It also anticipates a 40% drop in revenue for 2026, citing security and regulatory challenges as contributing factors.
Bitcoin Depot has projected a 40% decline in revenue for 2026 following a significant security breach. The company cited ongoing security and regulatory challenges as factors in the anticipated loss.
As detailed in an 8K report filed with the SEC, the firm lost approximately $3.665 million on March 23. The attacker used compromised credentials to steal 50.903 Bitcoin from internal systems.
Investigators noted a delay in the company’s response to the incident. Blockchain investigator ZachXBT stated that suspicious fund outflows actually occurred on March 20, with funds sent to KuCoin deposit addresses.
“I traced it out and the suspicious outflows actually occurred on March 20 and the funds were transferred to Kucoin deposit addresses,” ZachXBT noted. This three-day detection gap led some users to criticize the firm’s security response.
The incident coincides with a broader spike in sophisticated cryptocurrency scams. Attackers recently attempted to steal roughly $1 billion from Bybit using methods similar to the historic Mt. Gox exploit.
Simultaneously, ZachXBT disclosed a separate scheme exploiting about $1 million monthly from crypto fraud. The investigator linked the operation to an internal North Korean payment server involving over 390 accounts.
The patterns were consistent with those of DPRK IT workers, according to the findings. Funds from this scheme were converted to fiat via Chinese bank accounts using platforms like Payoneer.
