Bitcoin Depot discloses $3.6M BTC theft from corporate wallets in SEC filing, two weeks after breach

Bitcoin Depot, one of the largest Bitcoin ATM operators in the United States and a Nasdaq‑listed company (ticker BTM), disclosed in an SEC Form 8‑K that it suffered a corporate security breach resulting in the theft of 50.903 BTC from company‑controlled wallets, valued at about $3.665 million at the time of the incident. According to the filing, on March 23, 2026 an unauthorized party gained access to certain internal IT systems and obtained credentials for the firm’s digital asset settlement accounts, which were then used to initiate unauthorized transfers of bitcoin out of corporate wallets. Bitcoin Depot said it activated its incident response plan, engaged external cybersecurity specialists, and notified law enforcement after discovering the intrusion. The company stressed in the SEC disclosure and subsequent coverage that the breach was limited to its corporate environment and did not impact customer-facing platforms, ATM machines, user accounts, or customer data. It has booked a preliminary loss estimate of $3.665 million based on the fair value of the stolen bitcoin at the time, while warning that the ultimate financial impact could change as the investigation continues and that insurance coverage may not fully offset the loss. Reporting notes that Bitcoin Depot classified the incident as material due to potential legal, compliance, and reputational consequences, even though its operations have not been materially disrupted. The incident highlights ongoing security risks around corporate settlement infrastructure in the crypto sector, as attackers targeted internal credentials rather than end‑user wallets or physical ATMs. Analysts and commentators have framed the case as part of a broader pattern of credential theft and infrastructure compromises in crypto businesses, with some external observers also criticizing the time it reportedly took to detect the suspicious outflows and raising questions about internal monitoring and controls. As of the latest public information, the investigation into the attackers’ identity and the full scope of the compromise remains open.

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• Bitcoin Depot hack leads to $3.6M Bitcoin theft via stolen credentials (securityaffairs.com)
• Bitcoin Depot Discloses $3.6M BTC Theft After Hack on Settlement ... (mexc.com)
• Bitcoin Depot Reports $3.6m Crypto Theft After System Breach (infosecurity-magazine.com)
• Bitcoin Depot, the crypto ATM giant, hit by $3.6M theft - Escudo Digital (escudodigital.com)
• Bitcoin Depot hack: $3.665M in BTC stolen from corporate wallets ... (en.cryptonomist.ch)

Explore the topic

• BTC
• SEC
• wallets
• Bitcoin