Hackers Breach Bitcoin Depot, Steal $3.6 Million

[Smartvirus]

This amount is more than half of their income in 2025, so this year will be disastrous in terms of profits. How can a company like this leave 50.9 Bitcoin in hot wallets where unauthorized access leads to all these losses (or at least not a multi-signature wallet)?

It certainly does make you wonder if, they are not well aware of the vulnerabilities with hot wallets and if they are, what security measures do they need to put in place to avoid or mitigate against any such activities as hot wallets are prone to hacks. Perhaps they thought very less of their hodlings and it only means more to them now that it’s lost. An insider job obviously and it’s just another warning for those within the space to do more on security as these hackers aren’t sleeping.

[asriloni]

It's a karma to their shitty service. They did shady to their atm users by selling bitcoin at non sense price without noticing their users. They were also charged massive fees too. They were always stealing money from their users.

Beside that it's kinda weird the hacker was able accessing the settlement account without getting struggled with the security verification. It seems this is the fault of bitcoin depot itself by not adding more security layers to their settlement account.

What an amateurish for a company that is registered on Nasdaq. It also shows how they were being careless with the money they stole from their atm users. 

[test2026]

If there are able to hack exchange wallets, options like trust wallet., this option is not very much safe according to me. Even if someone has lots of bitcoin in his physical wallet and by mistake he mentions this to a friend, here is good chance that the friend might try attack in future and take those wallets. What is the solution to this then ?

[fullfitlarry]

As per ZachXBT,



https://x.com/DarkWebInformer/status/2042318294812934477

[nemesis_incarnate]

If there are able to hack exchange wallets, options like trust wallet., this option is not very much safe according to me. Even if someone has lots of bitcoin in his physical wallet and by mistake he mentions this to a friend, here is good chance that the friend might try attack in future and take those wallets. What is the solution to this then ?

This would be no friend then.

The only reply to that would be to not to tell that you have that much of BTCs. Because of the risks.

[Zlantann]

But on a separate note how can a place that is charging a 9%+ vig on BTC in and out have such a low profit.
Did not read the report or anything else but was insurance mentioned anywhere? Taking a big hit like that hurts a lot, having at least some of the loss insured hurts a lot less.
-Dave

While it has insurance coverage for cyber-attacks, Bitcoin Depot says that this might not cover all losses directly resulting from the attack.

This report claims that Bitcoin Depot has an insurance policy to cover this attack but it might not cover the entire loss.

snipped

Bitcoin Depot is not security-conscious. They don't have a security system that monitors and reports transactions. Not knowing that their wallet has been compromised for three days is carelessness. I hope they will be fortunate enough to recover some of the stolen coins. 

[dezoel]

To be fair hackers are usually improving faster than security, which means that if there is a way to be hacked, a new way, first it's used to hack into something, THEN it's patched up and no longer working. Which means that there will ALWAYS be very good hackers who will get some money out of this.

And bitcoin made it easier, because while it's possible to hack into someone's accounts and steal money from their bank, it's miles easier to do that with bitcoin and the ability to follow the paper trail is harder with mixers and even without mixers just p2p would be easy to handle.

[Lida93]

Right, it's part and parcel of being a Bitcoin ATM operator, but still though they have the burden to hardened their security. They might have stop the hacks, but the hackers was able to get away with millions easy. I don't think that any services here might be ahead of the scammers, this kind of people are sophisticated enough to know the loophole and exploit before any of them knows what happened. Even if they react on time, gonna be too late. But then again, as I have said, they should really put everything in place to monitor any suspicious activity real time.

hackers don't wake up suddenly to attack and hack anyone, this takes them months and up to a year plus in some cases just studying and watching for exploits holes to get pass through with all the security layers that may be installed. Don't just wish for sophisticated hackers to pin their radar locked on you as a target, the chances of escaping is usually narrow, because in the first instance you're not even aware that you have been made a target for hack which could make what should have being a common small mistake turning to means of enormous loss.