On March 20, 2026, attackers used compromised credentials to access Bitcoin Depot’s digital asset settlement accounts and transfer 50.903 BTC (valued at approximately $3.665 million) from company-controlled wallets. Bitcoin Depot did not detect the unauthorized access until March 23, 2026, three days after the theft began. The breach was contained within its corporate environment — customer-facing platforms, user data, and customer environments were not affected. Bitcoin Depot operates over 25,000 Bitcoin ATMs and BDCheckout locations globally and is one of the largest Bitcoin ATM operators in the world. The company disclosed the incident publicly on April 9, 2026. In a separate prior incident (2025), Bitcoin Depot had disclosed a data breach affecting nearly 26,000 individuals whose personal information including names, addresses, and identification details was accessed.