The operator of a major Bitcoin ATM network, Bitcoin Depot, reported a security incident last month where hackers stole $3.665 million in Bitcoin from its digital wallets after infiltrating its network.

Bitcoin Depot, with over 25,000 ATMs and BDCheckout locations globally, reported $615 million in revenue in 2025.

According to a filing with the SEC, the intrusion was discovered on March 23 when the company detected unusual activity on some of its systems.

Despite swift action to contain the breach, the attackers were able to compromise settlement accounts and transfer more than 50 Bitcoin before their access was revoked.

Bitcoin Depot stated that on March 23, 2026, they detected unauthorized access to their systems. They immediately initiated their incident response plan, brought in cybersecurity experts, and alerted law enforcement.

The company discovered that around 50.903 Bitcoin, valued at approximately $3.665 million, had been transferred without authorization. Bitcoin Depot believes that only its corporate environment was compromised.

The company has informed law enforcement and enlisted third-party cybersecurity specialists to aid in the investigation.

While cyber insurance is in place, Bitcoin Depot acknowledges it may not fully cover all losses related to the incident.

On April 6, 2026, the company determined the incident to be significant, considering potential damage to its reputation, as well as legal, regulatory, and response costs.

The company has cyber insurance that may cover certain losses from this incident, but there’s no guarantee that it will cover all losses incurred.

Previously, Bitcoin Depot informed nearly 26,000 individuals about a 2024 data breach in which attackers compromised their systems to steal personal information (names, addresses, dates of birth, driver’s license numbers, email addresses, and phone numbers).

In December 2024, Byte Federal, another U.S. Bitcoin ATM operator, disclosed a similar security breach that exposed the data of 58,000 clients.