Iowa Supreme Court Rules Bitcoin Depot Owns Seized Scam Funds

$14,100

Cash Seized from Bitcoin ATM

0.2296

Bitcoin Transferred to Scammer

15 months

From Transaction to Court Decision

3 days

Between Deposit and Sheriff's Seizure

The Iowa Supreme Court ruled unanimously that Bitcoin Depot—not scam victim Carrie Carlson—owns $14,100 that Linn County deputies seized from a Cedar Rapids Bitcoin ATM in February 2024. The May 16, 2025 decision means Carlson, who deposited the cash while being defrauded by a "Geek Squad" impersonator, has no legal claim to recover her money from the operator even though the scammer's Bitcoin transfer is irreversible. This matters because it's the first appellate ruling to address whether Bitcoin ATM operators can keep seized funds when customers provably acted under third-party fraud. The decision arrives as Bitcoin Depot faces a separate Iowa Attorney General enforcement action alleging the company systematically fails to prevent elder fraud—the exact scenario Carlson experienced.

Case: In the Matter of Property Seized for Forfeiture from Bitcoin Depot Operating, LLC (No. 24-0882)

Court: Iowa Supreme Court

Filed: February 21, 2024 (Bitcoin Depot's application)

Decided: May 16, 2025

Legal Basis: Iowa Code § 809.5 (return of seized property); Restatement (Second) of Contracts § 175(2) (third-party duress)

Opinion: Justice Oxley, joined by all justices

What Happened: A Classic Impersonation Scam

On February 8, 2024, someone claiming to be from "Geek Squad" contacted Carrie Carlson and told her that her bank accounts had been compromised. The caller directed her to withdraw cash and convert it to Bitcoin to "avoid her accounts being impacted"—a textbook impersonation fraud. The next day, Carlson withdrew $14,100 from her personal bank accounts and deposited the cash into a Bitcoin Depot ATM inside an Amoco gas station in Cedar Rapids. Bitcoin Depot's system simultaneously transferred 0.22960970 Bitcoin to a wallet address the scammer had provided. To complete the transaction, Carlson had to answer a prompt asking whether the Bitcoin was going to her own wallet or someone else's. When she indicated it was going to another wallet, this warning appeared on the screen:

Bitcoin Depot's On-Screen Warning:

"STOP! Many BTC scams ask the victim to send BTC to another wallet. Before proceeding, please take the time to verify that you are sending this transaction to your own wallet. If you are not, please cancel this transaction."

Despite this warning, the system allowed Carlson to proceed by representing that she owned the destination wallet—which she did not.

Three days later, Carlson reported the fraud to the Linn County Sheriff's Office. Deputies obtained a search warrant and seized the $14,100 from the Bitcoin ATM on February 12—before the machine had been emptied. The bills Carlson deposited were still inside.

The Legal Fight: Who Owns Money Seized During a Fraud Investigation?

Bitcoin Depot filed an application under Iowa Code § 809.5 on February 21 seeking return of the seized cash. The statute requires law enforcement to return seized property "to the person who demonstrates a right to possession" when it's no longer needed for evidence and the state hasn't filed a forfeiture claim. Carlson moved to intervene on March 18 and filed a competing claim. Her argument: the contract with Bitcoin Depot should be voidable due to third-party duress under Restatement (Second) of Contracts § 175(2), which states:

Restatement (Second) of Contracts § 175(2):

"If a party's manifestation of assent is induced by one who is not a party to the transaction, the contract is voidable by the victim unless the other party to the transaction in good faith and without reason to know of the duress either gives value or relies materially on the transaction."

Carlson's theory: Bitcoin Depot had "reason to know" customers were acting under duress because the company displays the fraud warning shown above. By acknowledging that scams occur, Carlson argued, Bitcoin Depot cannot claim ignorance when a customer becomes a victim. The district court agreed. On April 30, 2024, Judge Christopher L. Bruns ordered the Linn County Sheriff's Office to return the $14,100 to Carlson. Bitcoin Depot appealed.

The Supreme Court's Reasoning: Warnings Don't Equal Knowledge

Writing for a unanimous court, Justice Oxley reversed. The analysis turned on whether Bitcoin Depot had "reason to know" that Carlson specifically was acting under duress when she made the deposit. The court found three fatal flaws in Carlson's argument: **1. Bitcoin Depot gave value in good faith.** Bitcoin Depot transferred 0.2296 Bitcoin from its own inventory to the scammer's wallet address the moment Carlson deposited the cash. Under § 175(2), that transfer of value protects Bitcoin Depot unless the company had reason to know about the duress. **2. A generalized warning is not specific knowledge.** The court held that Bitcoin Depot's fraud warning—displayed to all customers—does not constitute "reason to know" that any particular customer is being scammed. From the opinion:

"Bitcoin Depot's generalized knowledge that sometimes scammers try to defraud people into transferring Bitcoins using Bitcoin's irreversibly encoded technology is insufficient to establish that Bitcoin Depot had 'reason to know' of Carlson's particular duress."

— Justice Oxley, Iowa Supreme Court Opinion

The court compared Bitcoin Depot's warnings to product liability cases: manufacturers who warn about dangers typically avoid liability when consumers ignore those warnings. The warning demonstrates Bitcoin Depot's awareness of industry risks—but not knowledge of Carlson's specific fraud. **3. The "stolen property from pawnbroker" analogy doesn't fit.** The district court had analogized the case to Iowa Code § 714.28(2), which allows victims to recover stolen property from pawnbrokers upon showing a police report. The Supreme Court rejected this: pawnbrokers are statutorily regulated, and more importantly, Carlson deposited her own cash—not stolen property. The Bitcoin went to the scammer, not the cash now held by the sheriff.

The "Smart Contract" Detour the Court Rejected

The district court had relied on three law review articles to characterize Carlson's transaction as a "smart contract"—a self-executing agreement where "no person or court can reverse the transaction." Judge Bruns concluded that "the nature of smart contracting itself gives Bitcoin Depot reason to know of transactions being made under duress from a third party." The Supreme Court emphatically disagreed:

The Court's Response to "Smart Contract" Theory:

Not every Bitcoin transaction is a "smart contract": The automated nature of Bitcoin transfers doesn't create a separate category of contract law
Smart contracts aren't per se invalid: "No one suggests that smart contracts are per se invalid. Yet that is the effect of the district court's analysis, which voids the contract based solely on the 'nature of smart contracting.'"
Ordinary contract law applies: "We do not agree that smart contracts are not subject to the law and ordinary judicial process."

The court cited contract law scholars who argue that smart contracts "will not replace contract law," which remains "a remedial institution." The irreversibility of blockchain transactions doesn't exempt Bitcoin ATM operators from standard contract principles.

What This Means for Scam Victims

Carlson had to prove Bitcoin Depot had "reason to know" of her duress—a burden she could not meet with only the generalized fraud warning as evidence. The court found no indication that Bitcoin Depot's largely automated system had any knowledge that a scammer had contacted Carlson specifically. The opinion acknowledges Carlson "alleges that she was the victim of fraud," but emphasizes that "this proceeding determines only who has the greater right to possession of the funds seized and held by the Linn County Sheriff's Office." **What the ruling does NOT address:** Whether Carlson has any remaining claims against Bitcoin Depot outside the seized-property proceeding. The opinion is silent on whether she could pursue: - An individual tort claim for negligence or failure to prevent fraud - A claim as part of the Iowa Attorney General's pending enforcement action - Any federal claims under banking or consumer protection laws The court's analysis is strictly limited to Iowa Code § 809.5—who gets the seized cash. It does not preclude Carlson from arguing in other forums that Bitcoin Depot's fraud prevention measures were inadequate.

The Broader Context: Iowa's Enforcement Action Against Bitcoin Depot

This ruling lands while Iowa Attorney General Brenna Bird is actively litigating a separate case against Bitcoin Depot alleging the company systematically enables elder fraud. That November 2024 enforcement action claims Bitcoin Depot violated Iowa's consumer fraud act through: - Insufficient fraud warnings despite knowing elderly Iowans were losing life savings - Failure to train employees to recognize and prevent scams - Misleading marketing about transaction safety and irreversibility The AG's case includes at least five Iowa victims who lost amounts ranging from $9,000 to over $40,000 through Bitcoin Depot kiosks. Carlson's $14,100 loss fits precisely the pattern the state alleges. Here's the tension: the Supreme Court says Bitcoin Depot's fraud warning shows the company was trying to protect customers, not that it had knowledge of specific scams. But the AG's lawsuit argues those same warnings were inadequate window-dressing that allowed fraud to continue. Bitcoin Depot's warning becomes both shield (in this property dispute) and sword (in the state's enforcement case). The Carlson opinion does not discuss the AG lawsuit, which was filed seven months before this decision. The justices may not have considered the systemic allegations relevant to the narrow statutory question of who owns seized property.

How Bitcoin Depot's System Works (According to the Court Record)

Bitcoin Depot Assistant General Counsel Joel Rimby submitted an affidavit explaining the company's transaction flow: 1. **Customers review terms and conditions** before proceeding, including a provision stating "you expressly represent and warrant that you will only send funds to your own personal wallet and not the wallet of any third party." 2. **Customers acknowledge ownership transfers:** The terms specify that "all cash deposited into a machine owned by Bitcoin Depot becomes property of Bitcoin Depot upon deposit." 3. **The fraud prevention prompt:** When customers indicate Bitcoin is going to someone else's wallet, the transaction is "prohibited from completing" unless they certify ownership anyway. 4. **Bitcoin transfers from Bitcoin Depot's inventory:** When a user deposits cash and initiates a transaction, "Bitcoin Depot must transfer Bitcoins from its own inventory and send those Bitcoins to the wallet directed by the user." The court treated step 4 as the critical fact: Bitcoin Depot gave value by transferring its own Bitcoin to the destination wallet. Because Carlson directed that transfer, Bitcoin Depot performed its contractual obligation and suffered the loss when the Bitcoin went to a scammer.

The Only Comparable Case: An Abusive Ex-Husband

Iowa courts have applied Restatement § 175(2) only once before—and the facts could not be more different from Carlson's case. In *Dorale v. Dorale* (Iowa Ct. App. 2009), Sandra Dorale sought to void a contract conveying farmland to her abusive ex-husband Ray. Sandra's father pressured her to sign during a four-hour confrontation where Ray refused to leave the father's house until she signed. The court of appeals held the contract was voidable because "Ray was well aware of the pressure exerted on Sandra by her father." The key difference: Ray was physically present during the duress. He witnessed the four-hour standoff. He knew exactly why Sandra was signing. Bitcoin Depot, by contrast, processed Carlson's transaction through an automated kiosk. No human at Bitcoin Depot had any interaction with Carlson or knowledge of the phone call from the fake Geek Squad representative. The court found this distinction dispositive.

What Happens to the Bitcoin?

The opinion notes that Bitcoin Depot transferred 0.22960970 Bitcoin to the wallet address Carlson provided—the scammer's wallet. That transaction is "irreversibly encoded on a distributed blockchain," as the district court noted. The $14,100 in cash now returns to Bitcoin Depot, meaning Bitcoin Depot breaks even on the transaction: it gave Bitcoin worth $14,100 and receives $14,100 in cash back. Carlson loses both the cash and the Bitcoin. The scammer received Bitcoin that, at February 2024 prices (approximately $61,400 per BTC), was worth roughly $14,100. At current prices, that Bitcoin is worth approximately [market value varies]. The opinion does not indicate whether law enforcement has traced or frozen the destination wallet.

The Uncomfortable Question This Ruling Raises

If Bitcoin Depot's fraud warning protects the company from third-party duress claims under § 175(2), what warning would ever be insufficient? The court's logic suggests that only specific, real-time knowledge of an individual customer's duress would void the contract. But Bitcoin ATMs are designed to be automated and anonymous. No human reviews transactions in real time. The system that prevents human knowledge is the same system that prevents detection of fraud. This creates a paradox: the more automated and hands-off the Bitcoin ATM operator, the less "reason to know" about any individual customer's duress—and therefore the more protected the operator becomes from third-party duress claims. The court distinguished product liability warnings, where manufacturers avoid liability by warning about dangers. But in product liability, the consumer chooses to proceed with knowledge of the risk. Here, Carlson proceeded because the scammer told her to—she had no independent understanding that she was at risk despite the warning. Whether that distinction matters is now a question for the Iowa Attorney General's systemic fraud case, not for individual property disputes like Carlson's.

What This Means for Bitcoin ATM Operators

The Iowa Supreme Court just gave Bitcoin ATM operators a clear roadmap for defeating third-party duress claims: 1. **Display fraud warnings on screen** before completing transactions 2. **Include contractual terms** stating deposited cash becomes company property 3. **Require customers to certify** they own the destination wallet 4. **Transfer Bitcoin from company inventory** to establish that the operator "gave value" Do these four things, and courts will likely reject arguments that the operator had "reason to know" about third-party duress—even when the customer was provably defrauded. The opinion does not address whether operators have any affirmative duty to investigate suspicious transactions, refuse high-risk transactions, or implement velocity limits for elderly customers. Those questions remain open and are likely being litigated in the Iowa AG's enforcement action. What we know now: in Iowa, displaying a fraud warning and processing the transaction anyway does not give the operator "reason to know" about duress sufficient to void the contract.

What's Next

The case returns to Linn County District Court with instructions to return the $14,100 to Bitcoin Depot. Carlson's legal options are limited: - **No further appeal on the property dispute:** The Iowa Supreme Court's decision is final - **Potential claims in the AG enforcement action:** If the state prevails in showing Bitcoin Depot systematically enabled fraud, Carlson might be entitled to restitution as part of a broader settlement or judgment - **Individual civil claims unclear:** The opinion does not address whether Carlson could sue Bitcoin Depot for negligence, failure to prevent fraud, or violation of consumer protection laws outside the seized-property statute The bigger question is whether this opinion undermines the Iowa Attorney General's enforcement case. The AG alleges Bitcoin Depot's fraud prevention measures were inadequate as a matter of consumer protection law. The Supreme Court just held those same measures were adequate to defeat a duress defense in a contract dispute. Those are different legal questions—consumer fraud versus contract voidability—but the factual overlap is substantial. Bitcoin Depot will certainly cite this opinion in the AG litigation to argue its fraud warnings were reasonable. For now, Carrie Carlson is out $14,100, the scammer has untraceable Bitcoin, and Bitcoin Depot has a unanimous Supreme Court opinion saying it doesn't have to refund fraud victims when the cash is seized by police. That outcome may be legally sound under Iowa's seized-property statute and third-party duress doctrine. Whether it's the right policy outcome for an industry that the FTC says loses consumers $1.14 billion annually to scams is another question entirely—one this court did not answer.

Iowa Supreme Court Rules Bitcoin Depot Owns Seized Scam Funds, Not the Victim