Hackers Breach Bitcoin Depot, Steal $3.6 Million

[fullfitlarry]

https://www.sec.gov/Archives/edgar/data/1901799/000119312526147772/btm-20260406.htm

According to Bitcoin Depot filing with the U.S. Securities and Exchange Commission, there has been a breached on their system last March 23. However, they were late to contained it as the hackers was able to stole approximately 50.903 Bitcoin  valued at approximately $3.665 million as of the date of this report.

This is not the first time, in 2024 there was also a incident:

(https://www.bitdefender.com/en-us/blog/hotforsecurity/bitcoin-depot-data-breach-exposes-personal-info-of-nearly-27-000-customers).

Just another lessons for this 3rd party services to increase their vigilance against cyber attack.

[hugeblack]

This amount is more than half of their income in 2025, so this year will be disastrous in terms of profits. How can a company like this leave 50.9 Bitcoin in hot wallets where unauthorized access leads to all these losses (or at least not a multi-signature wallet)?

[Zlantann]

Just another lessons for this 3rd party services to increase their vigilance against cyber attack.

This is a big loss for the company. Bitcoin ATM operators are constantly targeted by hackers because they have to hold funds to process transactions. Sadly, the company's insurance package will not cover the entire loss. Having different layers of security is essential and makes hacking difficult. Companies should always be ahead of scammers to avoid such losses.  

[coinrifft]

Just another lessons for this 3rd party services to increase their vigilance against cyber attack.

This is a big loss for the company. Bitcoin ATM operators are constantly targeted by hackers because they have to hold funds to process transactions. Sadly, the company's insurance package will not cover the entire loss. Having different layers of security is essential and makes hacking difficult. Companies should always be ahead of scammers to avoid such losses.  

Right, it's part and parcel of being a Bitcoin ATM operator, but still though they have the burden to hardened their security. They might have stop the hacks, but the hackers was able to get away with millions easy. I don't think that any services here might be ahead of the scammers, this kind of people are sophisticated enough to know the loophole and exploit before any of them knows what happened. Even if they react on time, gonna be too late. But then again, as I have said, they should really put everything in place to monitor any suspicious activity real time.

[DaveF]

Well it sucks to be me again



But on a separate note how can a place that is charging a 9%+ vig on BTC in and out have such a low profit.
Did not read the report or anything else but was insurance mentioned anywhere? Taking a big hit like that hurts a lot, having at least some of the loss insured hurts a lot less.

-Dave

[Dunamisx]

Just another lessons for this 3rd party services to increase their vigilance against cyber attack.

There's no security measure the can take that can prevent these hackers from bypassing their system and protocols to take what is not theirs, only that the most painful aspect of this are the users involved that will be Affected because all their assets will be gone for life, this is also why we should understand the risk in using a custodial storage for our assets, anything that gives the third party authority over our coins is not at the best of our interest.

[Z-tight]

Companies that hold a large amount of BTC are always the target of hackers, it is up to the institution to be ready for such attacks and try to prevent it. Bitcoin depot is one of the largest BTC atm networks, so maybe that can explain why they had such a huge amount of BTC in a hot wallet. But even if you are going to store such a large amount this way, there should be some extra layer of security to prevent something like this from happening.

It is almost the same situation with centralized exchanges. They control a huge amount of money, yet, they keep falling victim to hackers and losing customer funds.

[Furball808]

This amount is more than half of their income in 2025, so this year will be disastrous in terms of profits. How can a company like this leave 50.9 Bitcoin in hot wallets where unauthorized access leads to all these losses (or at least not a multi-signature wallet)?

Clearly, they weren’t using their money for the right reasons. They should have invested more in cybersecurity knowing they hold this much bitcoin. This should teach them a lesson and goodluck if they can still recover after this…

[arzuo]

https://www.sec.gov/Archives/edgar/data/1901799/000119312526147772/btm-20260406.htm

According to Bitcoin Depot filing with the U.S. Securities and Exchange Commission, there has been a breached on their system last March 23. However, they were late to contained it as the hackers was able to stole approximately 50.903 Bitcoin  valued at approximately $3.665 million as of the date of this report.

This is not the first time, in 2024 there was also a incident:

(https://www.bitdefender.com/en-us/blog/hotforsecurity/bitcoin-depot-data-breach-exposes-personal-info-of-nearly-27-000-customers).

Just another lessons for this 3rd party services to increase their vigilance against cyber attack.

All these incidents have happened many times in the past and are still happening today. Therefore, exchange commissions should be more aware and vigilant!
Such incidents remind us that crypto security is not limited to the blockchain, but also has its importance in the weakest link in the system—company documents!

[Arenga pinnata]

Companies that hold a large amount of BTC are always the target of hackers, it is up to the institution to be ready for such attacks and try to prevent it. Bitcoin depot is one of the largest BTC atm networks, so maybe that can explain why they had such a huge amount of BTC in a hot wallet. But even if you are going to store such a large amount this way, there should be some extra layer of security to prevent something like this from happening.

It is almost the same situation with centralized exchanges. They control a huge amount of money, yet, they keep falling victim to hackers and losing customer funds.

Clearly, the security measures they have in place still can’t keep up with the ingenuity of hackers. since this doesn’t seem to be the first time this has happened, it’s evident that they still have vulnerabilities they need to address.

But in this case, I think hackers are always one step ahead. and clearly, this will only lead to a loss of trust in companies that have been successfully hacked. But I’m still amazed that, despite holding such a massive amount of Bitcoin, they still haven’t realized there’s a vulnerability that hackers could exploit.  

[noorman0]

This amount is more than half of their income in 2025, so this year will be disastrous in terms of profits. How can a company like this leave 50.9 Bitcoin in hot wallets where unauthorized access leads to all these losses (or at least not a multi-signature wallet)?

The attack vector is still under investigation. This attack extends to the backend. I assume if the hackers also gain access to the wallet signer's credentials, even if they implement a multisig wallet, it's nearly useless. This is why CEX hotwallets (most of which implement multisig) can still be hacked without high computing power.

[TokenTikas]

But on a separate note how can a place that is charging a 9%+ vig on BTC in and out have such a low profit.

The question does not end there because I also want to mention something else, which is how such a big organization could have a system that becomes so easily vulnerable and ends up losing that amount of bitcoin. There are many other things that can be said about this but for now, this is what I want to point out. If the matter turns out to be true, then it is really unfortunate but to me, the whole situation still feels a bit suspicious.