News Regulations Operators Protection Host

Important Context

The vast majority of Bitcoin ATM transactions are legitimate. Millions of users rely on Bitcoin ATMs for fast, convenient access to digital currency. This page focuses on the small number of operators with documented violations to help legitimate businesses and consumers identify and avoid bad actors.

Why Scammers Target Bitcoin ATMs (And Why This Matters for Legitimate Users)

Scammers exploit Bitcoin ATMs specifically because users value them for the same reasons legitimate customers do: fast settlement, convenience, privacy, and direct access to digital currency. These features are assets—they shouldn't prevent you from using them safely. The solution is identifying and removing bad operators, not limiting access for everyone else. By understanding how scams work and which operators have documented compliance issues, you can use Bitcoin ATMs confidently.

What to Look For in a Legitimate Bitcoin ATM Operator

License ComplianceHolds required money transmission licenses in their operating states and displays registration information.

Transparent FeesClearly displays total cost including exchange rate markup before you confirm the transaction.

Active MonitoringStaff are present and trained to identify suspicious activity and assist distressed customers.

Effective WarningsProvides clear, readable warnings about common scams with adequate time to review before proceeding.

Responsive SupportHas a process for consumers to report fraud, file complaints, and get assistance when needed.

Data SecurityProtects customer information with proper security measures and clear privacy policies.

Operators with Documented Violations

Operators facing state enforcement actions or civil litigation based on public records

Context: The enforcement actions below involve a small number of operators out of thousands operating nationwide. Most Bitcoin ATM operators conduct business responsibly and comply with regulations. This page tracks those with documented violations to help you identify which ones to approach with caution.

Bitcoin Depot
Operating as Lux Vending, LLC
Multiple Cases
  • Massachusetts (2026)
    AG Andrea Campbell lawsuit alleges 83% of large customers ($10K+) were scam victims, $10.6M in scam revenue (~60% of MA business). Five counts including drip pricing, exceeding fee caps, fraud facilitation, and securities fraud against investors.
  • Maine (2025)
    License denied; Consent Agreement requires $1.9 million payment to reimburse consumers. State cited concerns about consumer protection controls.
  • Iowa (Ongoing)
    AG petition alleges $7+ million in fraud processed through kiosks (2021-2024). Claims include fee disclosure concerns.
  • Florida & South Carolina
    Class actions filed regarding consumer protection practices and staff intervention protocols.
  • Georgia (2024)
    Data breach class action following exposure of approximately 27,000 users' personal information.

Bitcoin Depot disputes these allegations. Cases are ongoing. Read full Massachusetts analysis →

Athena Bitcoin
Athena Bitcoin, Inc.
Multiple Cases
  • District of Columbia
    DC AG lawsuit alleges 93% of deposits at DC machines were fraud-related during a 5-month period. Includes fee disclosure and licensing claims.
  • New Jersey, Ohio & Colorado
    Class actions allege changes to consumer protection safeguards. Individual loss claims range from $9,900 to $69,100.
  • Florida (TCPA)
    Class action regarding marketing text messages to consumers who requested opt-out.

Athena Bitcoin disputes these allegations. Cases are ongoing.

CoinFlip
GPD Holdings LLC
State Case
  • Iowa (Ongoing)
    AG identified $13.1 million in alleged scam transactions through CoinFlip BTMs. Petition includes claims about fee calculation transparency.

CoinFlip disputes these allegations. Case is ongoing.

Bitstop
ATM OPS INC
Multiple Cases
  • Nebraska (2025)
    Cease and desist order for operating 40+ unlicensed money transmission locations since August 2021. Failed to respond to regulator's July 2023 directive to apply for licensure. Multiple consumer fraud complaints including failure to deliver purchased Bitcoin and unauthorized charges.
  • Florida (Pending)
    Chicago Atlantic secured party action seeking kiosk collateral related to PowerCoin-linked machines. Part of broader Heller Capital Group enterprise unwind.
  • Related Litigation (Pending)
    Court filings identify corporate overlap with Heller Capital Group, alleged to have operated a fraudulent scheme involving ATM units. Bitstop listed as a "primary holding" in investor documents.

Bitstop disputes these allegations. The Nebraska order may become final if no hearing is requested. Fraud allegations related to the Heller/PowerCoin enterprise have not been adjudicated. Read full analysis →

RockItCoin
ROCKITCOIN, LLC
DFPI Consent Order
  • California (2026)
    DFPI Consent Order for violations of Digital Financial Assets Law (DFAL) at 307 California kiosks: exceeding $1,000 daily transaction limit, charging fees above the 15% cap, and receipt deficiencies. Approximately $202,814 in aggregate consumer overcharges from Jan–Aug 2025.
  • Restitution & Penalty
    Ordered to pay $202,814.22 in consumer restitution plus a $75,000 administrative penalty. Must submit compliance reports every 60 days for one year.
  • Missouri (Ongoing)
    AG Civil Investigative Demand as part of statewide investigation into Bitcoin ATM fee disclosure and fraud facilitation practices.

RockItCoin entered the California consent order without admitting or denying the findings. Missouri investigation is preliminary. Read full analysis →

Cash2Bitcoin
Digital Access, LLC (also: CedarBTM)
3 Consent Orders
  • Alabama (2022)
    Consent Order for unlicensed money transmission. Operated ATMs from Aug 2021–Jan 2022 without a license, processing $272,744 in transactions. Paid $13,500 in penalties and investigation costs.
  • Connecticut (2025)
    Consent Order for unlicensed money transmission. Two consumer complaints resulted in third-party crypto transfers. Paid $10,000 civil penalty plus restitution to affected consumers.
  • Minnesota (2025)
    Consent Order for unlicensed money transmission. Cash2Bitcoin voluntarily exited the state. Paid $6,635 in penalty and investigative costs.

All three matters are resolved. Pattern involves operating ATMs before obtaining state licenses. No fraud or consumer harm allegations beyond licensing violations. View operator profile →

Hermes Bitcoin & Coin Time
Anh Management / Coin Time, LLC
DFPI Orders
  • California (2025)
    DFPI Desist and Refrain Orders for alleged violations of Digital Financial Assets Law (DFAL): transaction limits, fee caps, and disclosure requirements.
  • Proposed Penalties
    DFPI signaled intent to assess penalties up to $60.8 million for Hermes Bitcoin and $497 million for Coin Time.

Operators may contest these orders. Proceedings ongoing.

Byte Federal
Byte Federal, Inc.
Data Breach & Class Action
  • Data Breach (September 2024)
    Cyberattack via GitLab vulnerability exposed personal data of approximately 58,000 customers including SSNs, government IDs, photographs, and transaction history. Breach discovered November 18, 2024; notification sent December 12, 2024.
  • Florida (2025)
    Class action lawsuit (Fisher et al. v. Byte Federal, CACE-25-002678) filed in Broward County alleging inadequate cybersecurity. Preliminary settlement approved April 2025: up to $3,080 per person plus 2 years credit monitoring.
  • Missouri (Ongoing)
    AG Civil Investigative Demand as part of statewide investigation into Bitcoin ATM fee disclosure and fraud facilitation practices (January 2026).

Byte Federal has not admitted wrongdoing in the class action settlement. No customer funds or digital assets were compromised in the breach. Read full analysis →

Coinme
Coinme, Inc. (Voucher-Based Service)
Multiple Cases
  • Washington State (December 2025)
    DFI cease-and-desist order after examiners found $8.37 million in unredeemed customer vouchers booked as company revenue. Fine of $300,000; license revocation and 10-year industry ban sought for CEO Neil Bergquist. Temporary consent order in place.
  • California DFPI (June 2025)
    First-ever DFAL enforcement action. Consent order for exceeding $1,000/day transaction limits and 4,050+ receipts missing required disclosures. $300K fine plus $226.7K restitution to California consumers.
  • SEC Settlement (April 2023)
    Settled charges for unregistered securities offering (UpToken). Total penalties of $3.92M ($3.52M Up Global SEZC + $250K Coinme Inc. + $150K Bergquist). CEO fined with 3-year officer/director bar.

Coinme operates a voucher-based service through Coinstar kiosks, not traditional Bitcoin ATMs. Not listed in our ATM directory. Learn more about Coinme →

NMLS Consumer Access Data

Regulatory licensing records from the Nationwide Multistate Licensing System

About NMLS: The NMLS Consumer Access portal allows consumers to verify that money transmitters (including Bitcoin ATM operators) are properly licensed. The "Adverse Actions" count reflects regulatory actions such as consent orders, settlements, cease and desist orders, or license denials. A higher number doesn't necessarily indicate current problems—many operators resolve issues and maintain good standing.

Operator Legal Entity NMLS ID States Licensed Adverse Actions
Bitcoin Depot Bitcoin Depot Operating LLC 1886902 33 3
CoinFlip GPD Holdings LLC 1975146 39 2
RockItCoin ROCKITCOIN, LLC 1527313 28 1
Athena Bitcoin Athena Bitcoin, Inc. 1679249 18 2
Byte Federal Byte Federal, Inc. 2327474 16 1
Bitstop ATM OPS INC 1833409 13 3
Cash2Bitcoin Digital Access, LLC 2185177 12 3
Coinhub LSGT Services LLC 2344713 10 1

Data source: NMLS Consumer Access (nmlsconsumeraccess.org). Last verified: January 2026. Verify current status directly at NMLS.

Problems Identified in Enforcement Actions

Recurring issues cited in litigation against the operators listed above

Impersonation Scams

Scammers pose as federal agents (CBP, US Marshals, IRS) or tech support (Apple, Microsoft) to coerce victims into depositing cash. Legitimate agencies never request Bitcoin payment.

Fee Disclosure Issues

Some operators advertise low flat fees while additional costs are embedded in the exchange rate. Good operators clearly show total cost before confirmation.

Vulnerable Consumer Protection

Consumers over 60 account for over two-thirds of reported losses. Good operators train staff to recognize and assist distressed customers.

Warning Effectiveness

On-screen warnings can be bypassed when scammers keep victims on the phone. Effective operators require meaningful interaction with warnings.

Refund Policy Clarity

Litigation has cited unclear or undisclosed refund policies. Good operators clearly communicate what remedies are available before transactions.

Licensing Requirements

Multiple actions cite operating without required state money transmission licenses. Check that operators are properly licensed in your state.

How to Use Bitcoin ATMs Safely

1

Government agencies never accept Bitcoin. The IRS, Social Security, CBP, and law enforcement will never ask you to pay via Bitcoin ATM.

2

Hang up and verify independently. If someone calls claiming you owe money or have a legal issue, hang up and call the agency directly using their official number.

3

Know the total cost upfront. Ask for the complete fee including any exchange rate markup before confirming your transaction.

4

Read all on-screen warnings. Take time to review every screen. If someone is pressuring you to rush, that's a red flag.

5

Use operators with visible licensing. Legitimate operators display their money transmitter license information on the machine or receipt.

6

Report problems promptly. If something seems wrong, contact the FTC (reportfraud.ftc.gov), your state AG, and local law enforcement.

Supporting the Legitimate Bitcoin ATM Industry

The Bitcoin ATM industry provides important financial access and convenience. Millions of Americans use Bitcoin ATMs for legitimate purposes—converting cash to digital currency quickly and privately. By choosing operators with proper licensing, transparent fees, and good safety practices, you support responsible businesses and help eliminate bad actors through market forces. If you've had a good experience with a compliant Bitcoin ATM operator, that's the kind of business that should thrive in this space. Your informed choices help shape a better industry for everyone.

Official Resources

Where to report problems and get help

Disclaimer: This page documents operators with publicly reported legal actions based on court filings, regulatory orders, and news reports. The presence of an operator does not imply guilt—allegations are disputed and cases may be ongoing. This information is educational only and does not constitute legal advice. Thousands of Bitcoin ATM operators conduct lawful, compliant business daily. Always conduct your own research when choosing an operator. Last updated: February 2026.