More than $3.6 million was stolen from cryptocurrency ATM company Bitcoin Depot in a cyberattack on March 23. 

Bitcoin Depot filed a notice with the Securities Exchange Commission (SEC) explaining that a threat actor “gained access to certain systems and obtained control of credentials associated with the company’s digital asset settlement accounts.”

“As a result, the unauthorized actor transferred approximately 50.903 Bitcoin from company-controlled wallets, valued at approximately $3.665 million as of the date of this report, without authorization,” the company said. 

“[Bitcoin Depot] further believes that the incident was contained to the company’s corporate environment and did not affect the Company’s customer platforms, divisions, systems, data or environments.”

Outside cybersecurity experts have been brought in to help with the investigation and law enforcement was notified of the incursion. 

Bitcoin Depot said there is no evidence that customer information was accessed or exfiltrated during the incident. The company does not believe the attack will have an impact on operations but decided to notify the SEC “in light of potential consequences of the incident, including reputation harm, legal, regulatory and response costs.” 

The investigation is ongoing and Bitcoin Depot has not determined the full impact of the incident, warning that the initial assessment may change. 

Bitcoin Depot is the largest cryptocurrency ATM company in the U.S., allowing customers to convert cash to Bitcoin at more than 9,000 kiosks across 47 states. The company reported $614.9 million in revenue for 2025. 

The company did not respond to requests for comment about whether this incident was tied to other recent cryptocurrency thefts which have dominated headlines over the last two weeks. 

One week ago, decentralized finance platform Drift confirmed that $280 million was withdrawn from the platform during a security incident attributed to hackers from North Korea. 

Blockchain research company Chainalysis reported that $3.4 billion was stolen from cryptocurrency companies in 2025. In addition to the $280 million stolen from Drift last week, 2026 has already seen crypto thefts involving $26 million and $40 million worth of cryptocurrency.