Hackers Breach Bitcoin Depot, Steal $3.6 Million

[fullfitlarry]

https://www.sec.gov/Archives/edgar/data/1901799/000119312526147772/btm-20260406.htm

According to Bitcoin Depot filing with the U.S. Securities and Exchange Commission, there has been a breached on their system last March 23. However, they were late to contained it as the hackers was able to stole approximately 50.903 Bitcoin  valued at approximately $3.665 million as of the date of this report.

This is not the first time, in 2024 there was also a incident:

(https://www.bitdefender.com/en-us/blog/hotforsecurity/bitcoin-depot-data-breach-exposes-personal-info-of-nearly-27-000-customers).

Just another lessons for this 3rd party services to increase their vigilance against cyber attack.

[hugeblack]

This amount is more than half of their income in 2025, so this year will be disastrous in terms of profits. How can a company like this leave 50.9 Bitcoin in hot wallets where unauthorized access leads to all these losses (or at least not a multi-signature wallet)?

[Zlantann]

Just another lessons for this 3rd party services to increase their vigilance against cyber attack.

This is a big loss for the company. Bitcoin ATM operators are constantly targeted by hackers because they have to hold funds to process transactions. Sadly, the company's insurance package will not cover the entire loss. Having different layers of security is essential and makes hacking difficult. Companies should always be ahead of scammers to avoid such losses.  

[coinrifft]

Just another lessons for this 3rd party services to increase their vigilance against cyber attack.

This is a big loss for the company. Bitcoin ATM operators are constantly targeted by hackers because they have to hold funds to process transactions. Sadly, the company's insurance package will not cover the entire loss. Having different layers of security is essential and makes hacking difficult. Companies should always be ahead of scammers to avoid such losses.  

Right, it's part and parcel of being a Bitcoin ATM operator, but still though they have the burden to hardened their security. They might have stop the hacks, but the hackers was able to get away with millions easy. I don't think that any services here might be ahead of the scammers, this kind of people are sophisticated enough to know the loophole and exploit before any of them knows what happened. Even if they react on time, gonna be too late. But then again, as I have said, they should really put everything in place to monitor any suspicious activity real time.

[DaveF]

Well it sucks to be me again



But on a separate note how can a place that is charging a 9%+ vig on BTC in and out have such a low profit.
Did not read the report or anything else but was insurance mentioned anywhere? Taking a big hit like that hurts a lot, having at least some of the loss insured hurts a lot less.

-Dave

[Dunamisx]

Just another lessons for this 3rd party services to increase their vigilance against cyber attack.

There's no security measure the can take that can prevent these hackers from bypassing their system and protocols to take what is not theirs, only that the most painful aspect of this are the users involved that will be Affected because all their assets will be gone for life, this is also why we should understand the risk in using a custodial storage for our assets, anything that gives the third party authority over our coins is not at the best of our interest.

[Z-tight]

Companies that hold a large amount of BTC are always the target of hackers, it is up to the institution to be ready for such attacks and try to prevent it. Bitcoin depot is one of the largest BTC atm networks, so maybe that can explain why they had such a huge amount of BTC in a hot wallet. But even if you are going to store such a large amount this way, there should be some extra layer of security to prevent something like this from happening.

It is almost the same situation with centralized exchanges. They control a huge amount of money, yet, they keep falling victim to hackers and losing customer funds.

[Furball808]

This amount is more than half of their income in 2025, so this year will be disastrous in terms of profits. How can a company like this leave 50.9 Bitcoin in hot wallets where unauthorized access leads to all these losses (or at least not a multi-signature wallet)?

Clearly, they weren’t using their money for the right reasons. They should have invested more in cybersecurity knowing they hold this much bitcoin. This should teach them a lesson and goodluck if they can still recover after this…

[arzuo]

https://www.sec.gov/Archives/edgar/data/1901799/000119312526147772/btm-20260406.htm

According to Bitcoin Depot filing with the U.S. Securities and Exchange Commission, there has been a breached on their system last March 23. However, they were late to contained it as the hackers was able to stole approximately 50.903 Bitcoin  valued at approximately $3.665 million as of the date of this report.

This is not the first time, in 2024 there was also a incident:

(https://www.bitdefender.com/en-us/blog/hotforsecurity/bitcoin-depot-data-breach-exposes-personal-info-of-nearly-27-000-customers).

Just another lessons for this 3rd party services to increase their vigilance against cyber attack.

All these incidents have happened many times in the past and are still happening today. Therefore, exchange commissions should be more aware and vigilant!
Such incidents remind us that crypto security is not limited to the blockchain, but also has its importance in the weakest link in the system—company documents!

[Arenga pinnata]

Companies that hold a large amount of BTC are always the target of hackers, it is up to the institution to be ready for such attacks and try to prevent it. Bitcoin depot is one of the largest BTC atm networks, so maybe that can explain why they had such a huge amount of BTC in a hot wallet. But even if you are going to store such a large amount this way, there should be some extra layer of security to prevent something like this from happening.

It is almost the same situation with centralized exchanges. They control a huge amount of money, yet, they keep falling victim to hackers and losing customer funds.

Clearly, the security measures they have in place still can’t keep up with the ingenuity of hackers. since this doesn’t seem to be the first time this has happened, it’s evident that they still have vulnerabilities they need to address.

But in this case, I think hackers are always one step ahead. and clearly, this will only lead to a loss of trust in companies that have been successfully hacked. But I’m still amazed that, despite holding such a massive amount of Bitcoin, they still haven’t realized there’s a vulnerability that hackers could exploit.  

[noorman0]

This amount is more than half of their income in 2025, so this year will be disastrous in terms of profits. How can a company like this leave 50.9 Bitcoin in hot wallets where unauthorized access leads to all these losses (or at least not a multi-signature wallet)?

The attack vector is still under investigation. This attack extends to the backend. I assume if the hackers also gain access to the wallet signer's credentials, even if they implement a multisig wallet, it's nearly useless. This is why CEX hotwallets (most of which implement multisig) can still be hacked without high computing power.

[TokenTikas]

But on a separate note how can a place that is charging a 9%+ vig on BTC in and out have such a low profit.

The question does not end there because I also want to mention something else, which is how such a big organization could have a system that becomes so easily vulnerable and ends up losing that amount of bitcoin. There are many other things that can be said about this but for now, this is what I want to point out. If the matter turns out to be true, then it is really unfortunate but to me, the whole situation still feels a bit suspicious.

[AVE5]

How can a company like this leave 50.9 Bitcoin in hot wallets where unauthorized access leads to all these losses (or at least not a multi-signature wallet)?

Some firms and individuals bitcoineers actually think it's a sort of empty threats when they're told about the risks of storing their funds in the exchange, especially when it's being hold in there for a long term without even undermining the vulnerability as a hot wallet where the wallets private keys are stored online which can be a target for hackers which also the wallet data's via kyc's  is a weakness for the hot wallets securities.
I'm also skeptical if the affected wallet was a signed with multi signature which of course should had straightened its security against unauthorized access to move funds off from the wallet.

[Zwei]

Companies should always be ahead of scammers to avoid such losses.

you can never be ahead of hackers, it's a cat and mouse game.
what they should have done, is have some safeguards in place so if they get hacked, the hackers don't just walk away with half of their funds, which they failed at.

But on a separate note how can a place that is charging a 9%+ vig on BTC in and out have such a low profit.

isn't the 9%+ vig why they have such low profits? i would think anyone wanting to get some bitcoin, and who doesn't mind KYC, etc... would just use a CEX or go P2P instead of paying those insane ATM rates?

[macson]

Just another lessons for this 3rd party services to increase their vigilance against cyber attack.

When it comes to cybersecurity, no company can truly guarantee that their services are completely secure. Even when they improve their security, there's still the potential for breaches because attackers are constantly improving their ability to outsmart them.

But for a company of that size, they should have precautions in place to minimize this risk. It's ridiculous how easily hackers exploited their systems to transfer Bitcoin out of their wallets. This indicates they aren't serious about securing their assets.

[Nwada001]

This is a huge loss for them since the case is still fresh. Let's hope the investigation can get them something and some of the stolen funds recovered even if not all, but one thing that baffles me is the company suffered a similar incident in 2024 and did not learn from it and patch all possible loopholes at least to prevent such large loss.

Companies should always be ahead of scammers to avoid such losses.

you can never be ahead of hackers, it's a cat and mouse game.
what they should have done, is have some safeguards in place so if they get hacked, the hackers don't just walk away with half of their funds, which they failed at.

Safeguard, you mean set the system in such a way that when there is a large withdrawal detected happening all at once, it gets all locked out, or what?