Hackers Breach Bitcoin Depot, Steal $3.6 Million

[fullfitlarry]

https://www.sec.gov/Archives/edgar/data/1901799/000119312526147772/btm-20260406.htm

According to Bitcoin Depot filing with the U.S. Securities and Exchange Commission, there has been a breached on their system last March 23. However, they were late to contained it as the hackers was able to stole approximately 50.903 Bitcoin  valued at approximately $3.665 million as of the date of this report.

This is not the first time, in 2024 there was also a incident:

(https://www.bitdefender.com/en-us/blog/hotforsecurity/bitcoin-depot-data-breach-exposes-personal-info-of-nearly-27-000-customers).

Just another lessons for this 3rd party services to increase their vigilance against cyber attack.

[hugeblack]

This amount is more than half of their income in 2025, so this year will be disastrous in terms of profits. How can a company like this leave 50.9 Bitcoin in hot wallets where unauthorized access leads to all these losses (or at least not a multi-signature wallet)?

[Zlantann]

Just another lessons for this 3rd party services to increase their vigilance against cyber attack.

This is a big loss for the company. Bitcoin ATM operators are constantly targeted by hackers because they have to hold funds to process transactions. Sadly, the company's insurance package will not cover the entire loss. Having different layers of security is essential and makes hacking difficult. Companies should always be ahead of scammers to avoid such losses.  

[coinrifft]

Just another lessons for this 3rd party services to increase their vigilance against cyber attack.

This is a big loss for the company. Bitcoin ATM operators are constantly targeted by hackers because they have to hold funds to process transactions. Sadly, the company's insurance package will not cover the entire loss. Having different layers of security is essential and makes hacking difficult. Companies should always be ahead of scammers to avoid such losses.  

Right, it's part and parcel of being a Bitcoin ATM operator, but still though they have the burden to hardened their security. They might have stop the hacks, but the hackers was able to get away with millions easy. I don't think that any services here might be ahead of the scammers, this kind of people are sophisticated enough to know the loophole and exploit before any of them knows what happened. Even if they react on time, gonna be too late. But then again, as I have said, they should really put everything in place to monitor any suspicious activity real time.

[DaveF]

Well it sucks to be me again



But on a separate note how can a place that is charging a 9%+ vig on BTC in and out have such a low profit.
Did not read the report or anything else but was insurance mentioned anywhere? Taking a big hit like that hurts a lot, having at least some of the loss insured hurts a lot less.

-Dave

[Dunamisx]

Just another lessons for this 3rd party services to increase their vigilance against cyber attack.

There's no security measure the can take that can prevent these hackers from bypassing their system and protocols to take what is not theirs, only that the most painful aspect of this are the users involved that will be Affected because all their assets will be gone for life, this is also why we should understand the risk in using a custodial storage for our assets, anything that gives the third party authority over our coins is not at the best of our interest.

[Z-tight]

Companies that hold a large amount of BTC are always the target of hackers, it is up to the institution to be ready for such attacks and try to prevent it. Bitcoin depot is one of the largest BTC atm networks, so maybe that can explain why they had such a huge amount of BTC in a hot wallet. But even if you are going to store such a large amount this way, there should be some extra layer of security to prevent something like this from happening.

It is almost the same situation with centralized exchanges. They control a huge amount of money, yet, they keep falling victim to hackers and losing customer funds.

[Furball808]

This amount is more than half of their income in 2025, so this year will be disastrous in terms of profits. How can a company like this leave 50.9 Bitcoin in hot wallets where unauthorized access leads to all these losses (or at least not a multi-signature wallet)?

Clearly, they weren’t using their money for the right reasons. They should have invested more in cybersecurity knowing they hold this much bitcoin. This should teach them a lesson and goodluck if they can still recover after this…

[arzuo]

https://www.sec.gov/Archives/edgar/data/1901799/000119312526147772/btm-20260406.htm

According to Bitcoin Depot filing with the U.S. Securities and Exchange Commission, there has been a breached on their system last March 23. However, they were late to contained it as the hackers was able to stole approximately 50.903 Bitcoin  valued at approximately $3.665 million as of the date of this report.

This is not the first time, in 2024 there was also a incident:

(https://www.bitdefender.com/en-us/blog/hotforsecurity/bitcoin-depot-data-breach-exposes-personal-info-of-nearly-27-000-customers).

Just another lessons for this 3rd party services to increase their vigilance against cyber attack.

All these incidents have happened many times in the past and are still happening today. Therefore, exchange commissions should be more aware and vigilant!
Such incidents remind us that crypto security is not limited to the blockchain, but also has its importance in the weakest link in the system—company documents!

[Arenga pinnata]

Companies that hold a large amount of BTC are always the target of hackers, it is up to the institution to be ready for such attacks and try to prevent it. Bitcoin depot is one of the largest BTC atm networks, so maybe that can explain why they had such a huge amount of BTC in a hot wallet. But even if you are going to store such a large amount this way, there should be some extra layer of security to prevent something like this from happening.

It is almost the same situation with centralized exchanges. They control a huge amount of money, yet, they keep falling victim to hackers and losing customer funds.

Clearly, the security measures they have in place still can’t keep up with the ingenuity of hackers. since this doesn’t seem to be the first time this has happened, it’s evident that they still have vulnerabilities they need to address.

But in this case, I think hackers are always one step ahead. and clearly, this will only lead to a loss of trust in companies that have been successfully hacked. But I’m still amazed that, despite holding such a massive amount of Bitcoin, they still haven’t realized there’s a vulnerability that hackers could exploit.  

[noorman0]

This amount is more than half of their income in 2025, so this year will be disastrous in terms of profits. How can a company like this leave 50.9 Bitcoin in hot wallets where unauthorized access leads to all these losses (or at least not a multi-signature wallet)?

The attack vector is still under investigation. This attack extends to the backend. I assume if the hackers also gain access to the wallet signer's credentials, even if they implement a multisig wallet, it's nearly useless. This is why CEX hotwallets (most of which implement multisig) can still be hacked without high computing power.

[TokenTikas]

But on a separate note how can a place that is charging a 9%+ vig on BTC in and out have such a low profit.

The question does not end there because I also want to mention something else, which is how such a big organization could have a system that becomes so easily vulnerable and ends up losing that amount of bitcoin. There are many other things that can be said about this but for now, this is what I want to point out. If the matter turns out to be true, then it is really unfortunate but to me, the whole situation still feels a bit suspicious.

[AVE5]

How can a company like this leave 50.9 Bitcoin in hot wallets where unauthorized access leads to all these losses (or at least not a multi-signature wallet)?

Some firms and individuals bitcoineers actually think it's a sort of empty threats when they're told about the risks of storing their funds in the exchange, especially when it's being hold in there for a long term without even undermining the vulnerability as a hot wallet where the wallets private keys are stored online which can be a target for hackers which also the wallet data's via kyc's  is a weakness for the hot wallets securities.
I'm also skeptical if the affected wallet was a signed with multi signature which of course should had straightened its security against unauthorized access to move funds off from the wallet.

[Zwei]

Companies should always be ahead of scammers to avoid such losses.

you can never be ahead of hackers, it's a cat and mouse game.
what they should have done, is have some safeguards in place so if they get hacked, the hackers don't just walk away with half of their funds, which they failed at.

But on a separate note how can a place that is charging a 9%+ vig on BTC in and out have such a low profit.

isn't the 9%+ vig why they have such low profits? i would think anyone wanting to get some bitcoin, and who doesn't mind KYC, etc... would just use a CEX or go P2P instead of paying those insane ATM rates?

[macson]

Just another lessons for this 3rd party services to increase their vigilance against cyber attack.

When it comes to cybersecurity, no company can truly guarantee that their services are completely secure. Even when they improve their security, there's still the potential for breaches because attackers are constantly improving their ability to outsmart them.

But for a company of that size, they should have precautions in place to minimize this risk. It's ridiculous how easily hackers exploited their systems to transfer Bitcoin out of their wallets. This indicates they aren't serious about securing their assets.

[Nwada001]

This is a huge loss for them since the case is still fresh. Let's hope the investigation can get them something and some of the stolen funds recovered even if not all, but one thing that baffles me is the company suffered a similar incident in 2024 and did not learn from it and patch all possible loopholes at least to prevent such large loss.

Companies should always be ahead of scammers to avoid such losses.

you can never be ahead of hackers, it's a cat and mouse game.
what they should have done, is have some safeguards in place so if they get hacked, the hackers don't just walk away with half of their funds, which they failed at.

Safeguard, you mean set the system in such a way that when there is a large withdrawal detected happening all at once, it gets all locked out, or what?

[tabas]

I guess companies like this needs to enter into an agreement with an insurance company for any breach that might happen to them. And also, they need to be more secured and aware that hackers are not playing around if they know that a company holds a lot of bitcoins.

When it comes to cybersecurity, no company can truly guarantee that their services are completely secure. Even when they improve their security, there's still the potential for breaches because attackers are constantly improving their ability to outsmart them.

None can guarantee but at least by getting a more secured one on expensive fee gives them the insurance that they'll be protected. And in case of a breach, they can demand something from that security agency why it has happened if they boast of how strong their security is.

[taufik123]

This amount is more than half of their income in 2025, so this year will be disastrous in terms of profits. How can a company like this leave 50.9 Bitcoin in hot wallets where unauthorized access leads to all these losses (or at least not a multi-signature wallet)?

Is it really that easy to hack without thinking about how to properly secure it with a multi-signature wallet?
so security gaps like this are exploited by scammers to hack more Bitcoins with the same method.

The hot wallet generated by Bitcoin Depot is a loophole where hackers can get in and sophisticated phishing attacks or software exploits can provide initial access and then once they have successfully entered the company's network the attacker can move laterally to find cryptographic keys and this kind of pattern is called a supply chain compromise attack.

A more prepared and updated security infrastructure is really needed for public services like this Bitcoin depot.
There must be an official security audit that regulates how the security level of crypto services is up to date and not easy to manipulate.

[Alphakilo]

https://www.sec.gov/Archives/edgar/data/1901799/000119312526147772/btm-20260406.htm

According to Bitcoin Depot filing with the U.S. Securities and Exchange Commission, there has been a breached on their system last March 23. However, they were late to contained it as the hackers was able to stole approximately 50.903 Bitcoin  valued at approximately $3.665 million as of the date of this report.

This is not the first time, in 2024 there was also a incident:

(https://www.bitdefender.com/en-us/blog/hotforsecurity/bitcoin-depot-data-breach-exposes-personal-info-of-nearly-27-000-customers).

Just another lessons for this 3rd party services to increase their vigilance against cyber attack.

You are right about 3rd party services increasing their vigilance because it is obvious that they are still struggling to contain and implement important security protocols, mostly when it comes to the data of their user base.
This also points to one common saying here and anywhere that 'not your keys, not your coins', because it is the bedrock of a solid security set up when dealing with crypto currencies investment.

One good thing though is that at least customers information remained intact but wallets were emptied and it's a good news.
 It's imperative to note also in this regard that, self custody is the best way to stay safe as compared to one's funds sitting in a provider's settlement later.

[AmoreJaz]

Just another lessons for this 3rd party services to increase their vigilance against cyber attack.

When it comes to cybersecurity, no company can truly guarantee that their services are completely secure. Even when they improve their security, there's still the potential for breaches because attackers are constantly improving their ability to outsmart them.

But for a company of that size, they should have precautions in place to minimize this risk. It's ridiculous how easily hackers exploited their systems to transfer Bitcoin out of their wallets. This indicates they aren't serious about securing their assets.

That is because hackers are always finding ways how to penetrate the system and find its vulnerabilities. With the continuous development and creation of new softwares, comes with better hacking tools. Hence, companies and sites should always update their security features to combat potential threats as they are holding significant funds.