Missouri AG Launches Investigation Into Five Major Bitcoin ATM Operators

Missouri Attorney General Catherine Hanaway has announced a statewide investigation into companies operating Bitcoin ATMs, citing national concerns about deceptive fee structures and the use of these machines by scammers to defraud consumers.

The Attorney General's Office has issued Civil Investigative Demands (CIDs) to five major Bitcoin ATM operators doing business in Missouri. These demands require companies to provide documentation about their business practices and disclose their anti-fraud policies and procedures.

Update — May 22, 2026: Missouri Escalates From CID to Lawsuit Against CoinFlip

Four months after issuing the Civil Investigative Demand, Missouri's top prosecutor has formally sued CoinFlip, alleging the operator "knowingly facilitated fraudulent transactions" on its Bitcoin ATM network in Missouri and demanding restitution for elderly victims. CoinFlip publicly characterized the suit as "meritless."

The escalation matters for two reasons. First, it confirms the January CIDs were not paper exercises — Missouri's investigation produced enough evidence in four months to support a formal complaint, at least against one of the five operators. Second, it places CoinFlip in a two-front state-AG war: the company already faces an active Iowa Attorney General consumer protection lawsuit filed in February 2025, in which Iowa's investigation found 94.92% of CoinFlip's transactions in that state were scam-related.

The "Knowingly Facilitated" Standard

The legal language matters. Missouri did not allege CoinFlip was merely negligent or under-resourced — the complaint reportedly accuses the company of knowingly facilitating fraud. That is a scienter-based allegation: it requires the state to show CoinFlip had actual or constructive knowledge that its kiosks were being used to defraud Missourians and continued operating without adequate intervention.

This tracks the pattern AGs in Massachusetts, D.C., and Iowa have established against other operators: cite internal compliance data, transaction monitoring records, and victim complaint volumes to argue the operator could not credibly claim ignorance. The Massachusetts AG lawsuit against Bitcoin Depot alleged the median victim was 67 years old, with over 70% of victims aged 60 or older. The D.C. AG's case against Athena Bitcoin alleged a median victim age of 71. Whether the Missouri complaint against CoinFlip alleges similar demographics remains to be confirmed from the filed complaint, which BitcoinATM.news has not yet obtained.

CoinFlip's "Meritless" Defense — Against What Record?

CoinFlip's response — calling the suit "meritless" — is a standard litigation posture, but it sits uncomfortably alongside the documented record. The Iowa AG investigation found that 94.92% of CoinFlip's transactions in that state were scam-related. CoinFlip is also resolving a 2023 data breach that exposed Social Security numbers and government IDs for 36,646 customers, and has previously entered consent orders with the Texas Department of Banking and the Minnesota Department of Commerce.

The company has not, in public filings, disputed the Iowa scam-rate figure with contrary data. A "meritless" defense in Missouri will need to address why the Missouri customer base would look meaningfully different from Iowa's — or argue that the underlying scam-rate methodology used by state AGs is itself flawed.

Open Questions on the Missouri Complaint

BitcoinATM.news has not yet obtained the filed complaint. Key questions we are tracking:

• Restitution amount. Missouri has demanded restitution for seniors but the dollar figure and victim count have not been publicly confirmed.
• Scam-rate evidence. Whether the complaint cites Missouri-specific transaction data analogous to the 94.92% figure in Iowa.
• Fee-disclosure counts. Whether Missouri brings drip-pricing or fee-disclosure counts in parallel with the scam-facilitation claim.
• Status of the other four CIDs. Whether Bitcoin Depot, RockItCoin, Athena Bitcoin, and Byte Federal face imminent escalation, settlement discussions, or ongoing document production.

The remainder of this article reflects coverage as originally published on January 27, 2026.

Companies Under Investigation

The following five operators have received Civil Investigative Demands [Updated: CoinFlip has since been sued; the other four remain under CID as of May 2026]:

All five companies own and operate numerous Bitcoin ATMs across Missouri. These machines allow consumers to buy and sell Bitcoin with cash.

Concerns Raised by the Investigation

The Attorney General's announcement highlights several key concerns about Bitcoin ATM operations:

Context: Growing Regulatory Scrutiny

Missouri's investigation follows a wave of state-level regulatory actions against Bitcoin ATM operators. Iowa Attorney General Brenna Bird has already filed lawsuits against Bitcoin Depot and CoinFlip, alleging over $20 million in consumer losses and hidden fees exceeding 20%.

This investigation is notable for its breadth, targeting five of the largest operators in the industry simultaneously. It also represents the first significant regulatory action against RockItCoin, which previously maintained a clean compliance record, and Byte Federal, one of the industry's newer operators.

Missouri's Existing Regulatory Framework

Missouri already has consumer protection laws applicable to cryptocurrency kiosks under RSMo 361.1100 (the Virtual Currency Kiosk Consumer Protection Act). The state legislature is also considering HB3043, which would authorize the Attorney General to bring civil actions against operators found in violation of consumer protection laws.

How Scams Work at Bitcoin ATMs

The Attorney General's office is encouraging consumers to be aware of common scam tactics involving Bitcoin ATMs:

Important: Legitimate government agencies, law enforcement, and businesses never demand payment via Bitcoin ATM. If you receive such a request, it is a scam.

What This Means for CoinFlip Customers and Missouri Scam Victims

Missourians who used a CoinFlip kiosk in connection with a scam now have a direct restitution pathway through the Attorney General's lawsuit, in addition to the existing complaint process. If you sent Bitcoin from a CoinFlip kiosk to someone you later realized was a scammer, you should:

What This Means for Operators

The Missouri CID-to-lawsuit timeline — four months from investigative demand to formal complaint against the first operator — is a useful benchmark for the four operators still under CID. Document production deadlines that looked theoretical in February are now operative risk windows. Compliance leadership at Bitcoin Depot, RockItCoin, Athena Bitcoin, and Byte Federal should assume Missouri is building parallel cases, not deciding whether to bring any case at all.

The "knowingly facilitated" framing is also instructive. Operators that have internal compliance reports — transaction-monitoring outputs, scam-rate estimates, victim-complaint logs — should assume those documents will be produced and used as direct evidence of knowledge. The defense that an operator "did not know" how its machines were being used has become harder to sustain as state AGs accumulate consistent findings across jurisdictions.

Operators with clean regulatory records can review the operators directory trust score methodology for benchmarking. Operators with multiple pending actions should expect coordination between state AGs to accelerate, not slow down.

What to Watch Next

Three near-term signals will indicate whether Missouri's CoinFlip suit is a one-off or a template:

1. Whether Missouri files a second lawsuit against one of the remaining four CID recipients in the next 60–90 days.
2. Whether CoinFlip's "meritless" public posture survives an answer to the complaint — or whether the company moves toward settlement discussions, as several operators have done in other states.
3. Whether the Missouri complaint, once docketed and public, cites a Missouri-specific scam-rate figure comparable to Iowa's 94.92%.

If a second Missouri lawsuit lands by late summer, the January CIDs will retrospectively look like the opening move of a coordinated five-defendant enforcement campaign — the most aggressive single-state action in Bitcoin ATM history.