HACKERS breached Bitcoin Depot on 23 March 2026, stealing login credentials and draining about 50.903 BTC from company-controlled wallets, worth approximately $3.665 million at the time. The incident allegedly gave the attackers control of credentials linked to the company’s digital asset settlement accounts, enabling unauthorised transfers, though Bitcoin Depot reported no evidence of stolen customer personal data.
The company activated incident response protocols, engaged external cybersecurity experts, notified law enforcement, and said the breach was contained to the corporate environment and did not affect customer platforms, divisions, systems, data or environments.
The situation is being investigated with ongoing assessments, and the company has recorded a preliminary loss figure of about $3.665 million, with insurance potentially covering part of the damage, though recovery is not guaranteed, according to a Form 8-K filed with the SEC. According to the SEC filing, the ultimate impact may differ as the investigation continues. The article notes that the breach had not disrupted operations but is considered material due to potential legal, reputational, and response costs.