Bitcoin Depot (NASDAQ: BTM) revealed that hackers stole approximately 50.903 Bitcoin — valued at roughly $3.665 million — from company-controlled wallets after gaining unauthorized access to its internal systems on March 23, 2026. The company filed the material cybersecurity incident disclosure with the SEC on April 8, 2026, fourteen days after discovering the breach.
For an operator already facing attorney general lawsuits in multiple states, a $3.7 million theft from its own corporate wallets raises immediate questions about the security infrastructure underpinning the largest Bitcoin ATM network in the United States. The filing states customer systems and data were not affected — but the breach landed squarely on the settlement accounts that move Bitcoin between the company's own operations. And it raises a question Bitcoin Depot has not yet answered: whether the 50.9 BTC stolen from those settlement accounts overlapped at all with the company's separately marketed "Bitcoin treasury" position — a publicly touted hoard that grew to roughly 107.9 BTC and a $10.9 million carrying value by year-end 2025.
Update — April 9, 2026: On-chain trace contradicts the disclosure timeline. Independent blockchain investigator ZachXBT has published a manual trace of the incident that materially contradicts Bitcoin Depot's Form 8-K. According to the trace:
- The theft began March 20, 2026 — three days earlier than the March 23 date in the filing. ZachXBT identified 19 high-confidence theft addresses with activity starting March 20, meaning Bitcoin Depot "took three days to notice the funds were missing from its business."
- The amount compromised may be 54.45 BTC, not 50.9 BTC — a delta of 3.55 BTC that ZachXBT says "indicates other employee personal accounts may have also been impacted." The trace shows a 7.635 BTC flow from what it labels an "exchange account" moving into the same KuCoin deposits as the 19 company-wallet addresses.
- 54 BTC ($3.7M) was consolidated to KuCoin on March 22, 2026 — one day before Bitcoin Depot says it discovered the loss, and more than two weeks before the 8-K was filed. ZachXBT describes KuCoin as "a crypto exchange increasingly used by illicit actors."
- None of the 19 theft addresses had been flagged by compliance tools as of ZachXBT's post, meaning the illicit flows moved through the crypto compliance infrastructure without being caught.
The trace is independently verifiable on the Bitcoin blockchain. If accurate, the disclosure understated both the discovery delay (three days, not one) and the scope of the compromise. Bitcoin Depot has not publicly responded to the on-chain findings as of this update.
What the Filing Says
Filing: Form 8-K (Item 1.05 — Material Cybersecurity Incident)
Registrant: Bitcoin Depot Inc. (NASDAQ: BTM)
Filed: April 8, 2026
Date of Earliest Event: April 6, 2026 (materiality determination)
Signed by: Christopher Ryan, General Counsel and Corporate Secretary
Key Disclosures from the 8-K:
- The breach was contained to Bitcoin Depot's corporate environment — customer platforms, data, and customer-facing systems were not affected
- No evidence that customer personally identifiable information was accessed or exfiltrated (investigation ongoing)
- Preliminary estimated loss: $3.665 million (fair value of stolen BTC as of incident date)
- Bitcoin Depot maintains cybersecurity insurance but provides "no assurance" it will cover the losses
- The company says the incident is "not reasonably likely to have a material impact" on financial condition or results, despite deeming the incident itself material
Settlement Account or Treasury? The Question the 8-K Doesn't Answer
The most consequential ambiguity in the 8-K is its choice of words. Bitcoin Depot says the attacker "obtained control of credentials associated with the Company's digital asset settlement accounts." Settlement accounts and treasury accounts are not the same thing — and Bitcoin Depot has spent the last two years aggressively marketing itself as both. Settlement accounts are operational working wallets. They hold Bitcoin in transit between Bitcoin Depot's roughly 9,700 kiosk machines and the exchanges and counterparties the company settles with. Bitcoin moves through them constantly as a cost of doing the cash-in/cash-out business. A loss from a settlement account is a loss to operations. A treasury position is something else entirely. In June 2024, Bitcoin Depot publicly launched a "Bitcoin treasury strategy" — a deliberate decision to hold Bitcoin on its corporate balance sheet as a long-term store of value, modeled on Strategy (formerly MicroStrategy). The company issued press releases for each tranche it bought. By February 2025 it confirmed roughly 94 BTC. By June 2025 it announced "over 100 BTC." Third-party tracker Bitcointreasuries.net last reported 107.9 BTC at an average cost basis of approximately $91,735 per coin. That hoard appears on the audited balance sheet. Bitcoin Depot's full-year 2025 financial statements list a "Cryptocurrencies" line item of $10,927,000 as of December 31, 2025 — up from just $1,510,000 a year earlier. The 2025 cash flow statement shows $8,473,000 in "Acquisition of cryptocurrency for investment" plus a $2,576,000 unrealized loss on those holdings. That is Bitcoin Depot's declared treasury position, the one its investor communications were built around.Questions Bitcoin Depot has not answered:
- Are the company's treasury BTC holdings custodied separately from its operational settlement BTC, with a different credential system and key custody architecture?
- Was any portion of the 50.9 BTC stolen on March 23 part of the publicly disclosed treasury position — or, equivalently, what is the current BTC balance in the company's treasury accounts following the theft?
- If treasury and settlement BTC share custody infrastructure, what does that imply about the security of the remaining declared holdings?
- Has Bitcoin Depot filed an insurance claim, and what are the coverage limits and exclusions for crypto-asset theft from a corporate wallet compromise?
March 23: A Breach During a Cascade of Crises
The date of the breach — March 23, 2026 — is not an arbitrary data point. It lands at the exact inflection of the most turbulent six-week stretch in Bitcoin Depot's history as a public company. By the time hackers drained 50.9 BTC from its settlement wallets, the company had already lost a state license, lost a chief operating officer, lost roughly a third of its forward revenue outlook — and, the very same day as the breach, lost its chief executive and installed a new one. The cascade started on March 9, 2026, when the Connecticut Banking Commissioner suspended Bitcoin Depot's money transmission license and issued a temporary cease-and-desist order, citing excessive fees and a failure to refund scam victims. Two days later, on March 11, COO Elizabeth Simer resigned with no public explanation — and Bitcoin Depot disclosed in a same-day 8-K filing that it had identified internal control "weaknesses." On March 16, the company reported its Q4 2025 earnings — a $24.9 million net loss (including an $18.5 million arbitration accrual) and forward guidance projecting a 30-to-40 percent decline in core business revenue for 2026. Less than a month earlier, on February 23, Bitcoin Depot had completed a 1-for-7 reverse stock split — the kind of move companies typically make when their share price is approaching delisting thresholds. By the time of the new CEO's appointment, BTM stock was down roughly 88.8 percent over six months. That is the company that woke up on March 23 to discover its corporate Bitcoin wallets had been emptied. Bitcoin Depot went public in July 2023 with founder Brandon Mintz as CEO. Mintz transitioned out of the CEO role at the end of 2025, moving to Executive Chairman while Scott Buchanan took over as CEO on January 1, 2026. Buchanan's tenure lasted just 82 days. On March 23, 2026, Buchanan resigned, Mintz simultaneously stepped down as Executive Chairman and transitioned to a non-executive board member and advisor role, and former MoneyGram CEO Alex Holmes was appointed CEO and Chairman of the Board. Bitcoin Depot's Form 8-K says that is also when the company discovered the theft. But an independent on-chain trace by ZachXBT — published after the 8-K — dates the actual theft to March 20, 2026, three days before the leadership change. On that reading, the breach had been underway for three days before Holmes took office and before Bitcoin Depot publicly noticed it. The 8-K makes no mention of the leadership change — it was disclosed in a separate filing — but the overlap is extraordinary. On the same calendar day Bitcoin Depot's board installed a new chief executive to steady a company in crisis, hackers were draining $3.665 million in Bitcoin from its corporate settlement wallets. Any incident commander on March 23 had to contend not only with a live cybersecurity breach but with the fact that the executive nominally in charge had been in the seat for a matter of hours. The upheaval wasn't limited to the CEO chair — and the legal chair was arguably worse. Chris Ryan, who had joined Bitcoin Depot as Chief Legal Officer in early 2025, departed the company in early 2026. That means when the breach was discovered on March 23, the company did not have its senior legal officer in place. Ryan was only recruited back as part of the leadership overhaul that accompanied Holmes's arrival. His offer letter — filed as Exhibit 10.3 to an amended 8-K — explicitly states the company was "excited about you returning to Bitcoin Depot." He rejoined on March 30, 2026 under a new title, General Counsel and Corporate Secretary, with a $300,000 retention bonus paid over 12 months and 99,010 restricted stock units. By the time Ryan signed the April 8 cybersecurity 8-K, he had been back at Bitcoin Depot for just nine days. Whatever incident response, forensic engagement, outside-counsel retention, and materiality analysis occurred in the crucial first week after discovery happened while the senior legal seat at the company was effectively empty — and the rest of it was led by a lawyer whose return was still in its first fortnight. Bitcoin Depot also disclosed a retention bonus for its Chief Financial Officer — the kind of payment companies make when they're worried about losing key executives during periods of instability. When a company is simultaneously losing a state license, installing a new CEO on the same day as a multi-million-dollar theft, rehiring its General Counsel a week later, paying a retention bonus to keep its CFO, projecting a 30-to-40 percent revenue collapse, and managing active attorney general investigations in multiple states, the question of who was actually minding the cybersecurity infrastructure on March 23 takes on a different kind of weight.Bitcoin Depot's Six-Week Cascade — Crisis Timeline:
- Feb. 3, 2026: Massachusetts Attorney General sues Bitcoin Depot, alleging the company facilitated and profited from cryptocurrency scams
- Feb. 23, 2026: 1-for-7 reverse stock split takes effect
- March 9, 2026: Connecticut Banking Commissioner suspends Bitcoin Depot's money transmission license; issues temporary cease-and-desist citing excessive fees and failure to refund scam victims
- March 11, 2026: COO Elizabeth Simer resigns; company discloses internal control "weaknesses"
- March 16, 2026: Q4 2025 earnings: $24.9M net loss (including $18.5M arbitration accrual); 2026 core revenue guidance cut 30–40%
- Early 2026: Chief Legal Officer Chris Ryan departs the company; CFO receives a retention bonus amid instability
- March 20, 2026: Theft begins, per independent on-chain trace by ZachXBT — 19 high-confidence theft addresses identified; total apparently 54.45 BTC, including a 7.635 BTC flow from an "exchange account" suggesting an employee personal account was also compromised
- March 22, 2026: 54 BTC ($3.7M) consolidated and sent to KuCoin in a rapid laundering sequence — one day before Bitcoin Depot says it noticed the loss
- March 23, 2026: Founder Brandon Mintz steps down as Executive Chairman and transitions to a non-executive board member and advisor role; CEO Scott Buchanan departs after less than three months; Alex Holmes (former MoneyGram CEO) appointed CEO and Chairman — same day
- March 23, 2026: Bitcoin Depot notices the theft (three days late, per the on-chain evidence); will later disclose 50.9 BTC ($3.665M) stolen from company settlement wallets (Holmes's first day in role; CLO seat still vacant)
- March 30, 2026: Chris Ryan returns to Bitcoin Depot as General Counsel and Corporate Secretary with a $300,000 retention bonus and 99,010 RSUs (7 days after the breach)
- April 6, 2026: Company determines the breach is material
- April 8, 2026: 8-K filed with SEC; signed by General Counsel Christopher Ryan — back at the company for just 9 days — not the new CEO
The 14-Day Materiality Gap
Under SEC cybersecurity disclosure rules (adopted in 2023, effective December 2023), companies must file an 8-K within four business days of determining that a cybersecurity incident is material. Bitcoin Depot discovered the breach on March 23 but didn't make its materiality determination until April 6 — meaning the clock didn't start on the four-business-day disclosure requirement until then. The filing's own language hints at the deliberation involved: "On April 6, 2026, the Company nevertheless determined that the incident is material in light of potential consequences of the incident, including reputations harm, legal, regulatory and response costs." That word "nevertheless" is telling — it suggests the company initially believed the incident might not require disclosure but ultimately concluded the downstream risks (reputation, legal exposure, costs) pushed it over the materiality threshold. The $3.665 million loss is measured at the Bitcoin price on the date of the incident — not the current market value, which could be higher or lower depending on Bitcoin's price movement since March 23. The filing does not disclose whether any of the stolen Bitcoin has been recovered or traced on-chain.The Tangible Net Worth Problem: Why the Loss Could Trigger License Exposure
Bitcoin Depot's 8-K contains a pair of statements that sit in visible tension with each other. On one hand, the company "currently believes" the incident "is not reasonably likely to have a material impact on the Company's overall financial condition or results of operations." On the other, the company acknowledged the incident is material "in light of potential consequences of the incident, including reputations harm, legal, regulatory and response costs." The second sentence is the one that matters — and a closer look at Bitcoin Depot's year-end 2025 balance sheet helps explain why the company felt the need to include it.
The reason the "regulatory... costs" hedge carries weight is a specific capital metric called Tangible Net Worth (TNW). Many U.S. states require money transmitter licensees to maintain a minimum TNW as an ongoing condition of their license. If TNW falls below the threshold, the state regulator has the authority to suspend or revoke the license — which is exactly what happened on March 9, 2026, when Connecticut suspended Bitcoin Depot's money transmission license (on different grounds, but providing a live template for how quickly a state regulator can act).
What the Balance Sheet Shows
According to Bitcoin Depot's Q4 / full-year 2025 financial statements, reported on March 16, 2026, the consolidated balance sheet at December 31, 2025 showed:
- Total assets: $130.443 million
- Total liabilities: $118.614 million
- Goodwill: $8.717 million
- Intangible assets: $0.804 million
- Cryptocurrencies: $10.927 million
- Total stockholders' equity: $11.829 million
The most common TNW formula — GAAP stockholders' equity minus goodwill minus intangibles — produces a pre-hack TNW of $2.308 million.
What the Hack Does to the Number
The $3.665 million theft reduces stockholders' equity dollar-for-dollar (no insurance recovery has been disclosed). Applied to the standard TNW formula, that drags Bitcoin Depot from a $2.308 million positive TNW to a negative $1.357 million TNW — a swing of $3.665 million into the red, before any downstream legal or remediation costs are counted.
The CSBS Benchmark
The Conference of State Bank Supervisors (CSBS), which coordinates money transmitter standards across the states, issued 2025 guidance setting the minimum TNW requirement as the greater of $100,000 or 3 percent of the first $100 million of total assets plus 2 percent of assets between $100 million and $1 billion. On Bitcoin Depot's year-end 2025 total assets of $130.443 million, that benchmark works out to approximately $3.609 million.
On the standard TNW formula, Bitcoin Depot was already running roughly $1.301 million below the CSBS benchmark at year-end 2025 — before the hack. The theft widens the shortfall to approximately $4.966 million below requirement.
The Crypto-Exclusion Wrinkle
CSBS's 2025 guidance also directs some states to exclude virtual-currency holdings from the TNW calculation, reflecting regulatory concerns about crypto price volatility. Under that stricter approach — TNW = total assets minus total liabilities minus goodwill minus intangibles minus crypto assets — Bitcoin Depot's pre-hack TNW was already negative $8.619 million. In that framework, the hack is mathematically neutral to TNW, because the stolen Bitcoin was never counted as tangible capital in the first place. The shortfall against the $3.609 million benchmark is simply already enormous.
In plain English: under either methodology, Bitcoin Depot has a capital problem. The hack either makes it materially worse (under the standard view) or leaves a company that was already far below the line (under the crypto-exclusion view).
Why This Could Cascade Across States
The Connecticut suspension on March 9, 2026 — issued over excessive-fee and scam-refund failures rather than TNW — was the first state to act. It is also the operating template for what happens when a state concludes a licensee no longer meets the conditions of its license: the state can suspend operations, issue a cease-and-desist, and strand the licensee's machines in that jurisdiction within days. Bitcoin Depot operates in dozens of states. If any other state examines the company's year-end 2025 financials against its TNW test — or looks at the post-hack pro-forma numbers and concludes the company is below threshold — that state has the same legal authority Connecticut exercised.
Each lost license means lost revenue from the ATM network in that state. A cascading review of Bitcoin Depot's licenses across the roughly 48 states in which it operates could compress the company's operational footprint more severely than any single enforcement action has to date. This is why the 8-K's "legal, regulatory, and response costs" phrase sits directly alongside the "currently believes... not material" hedge: the near-term cash loss is $3.665 million, but the downstream regulatory exposure could be an order of magnitude larger.
Important Caveats
These figures are computed from the consolidated public-company financial statements. State TNW tests vary by statute, by regulator, and — importantly — by which specific licensed entity is examined. Bitcoin Depot's money transmitter licenses are generally held by subsidiaries (the operating entity is Bitcoin Depot Operating LLC), and that subsidiary's standalone TNW may differ from the consolidated figures above. The practical licensing question is not just "what is Bitcoin Depot's consolidated TNW" but "which entity is licensed in each state, and does that state's TNW rule include or exclude crypto assets under the new GAAP fair-value treatment." Neither the 8-K nor the Q4 earnings materials resolve that question on a state-by-state basis, and Bitcoin Depot has not publicly disclosed entity-level TNW figures for its licensed subsidiaries.
Disclosure Pattern: The 2024 Data Breach Precedent
The fourteen-day gap between discovery and materiality determination is not the first time Bitcoin Depot has held cybersecurity information close. On June 23, 2024, the company detected suspicious activity on its internal systems and ultimately determined that the personal information of 26,732 customers had been exposed. Bitcoin Depot did not notify affected customers until July 2025 — a roughly 13-month delay from detection — citing a federal law enforcement request to withhold public notification. A note on scope: some aggregator reports have cited a figure of up to 58,000 affected users, but that number is not confirmed by Bitcoin Depot's own breach notices or by Cointelegraph's primary reporting, and it may reflect confusion between the June 2024 incident and a separate, older data exposure. This article refers specifically to the confirmed 2024 breach (26,732 customers) unless otherwise noted. The contrast with the current incident is instructive. For a data breach affecting 26,732 consumers, Bitcoin Depot took 13 months to disclose. For a $3.665 million corporate Bitcoin theft that the SEC's 2023 cybersecurity rules require be disclosed within four business days of a materiality determination, the company took two weeks to make that determination — and then filed within the required window. A federal law enforcement hold is a legitimate reason to delay a consumer breach notification. But it is worth noting that in each case, the public learned the details on a timeline largely set by the company's own internal judgments and the external rules that eventually forced the issue.Bitcoin Depot's confirmed security incidents:
- June 23, 2024: Customer data breach detected; 26,732 customers' personal information exposed. Public notification: July 2025 (~13-month delay, attributed to a federal law enforcement hold)
- March 23, 2026: 50.9 BTC ($3.665M) stolen from corporate settlement wallets. SEC 8-K filed April 8, 2026 — 16 days after discovery, 2 days after materiality determination
Note: Some aggregator sources cite an additional or older incident affecting up to ~58,000 users. That figure is not confirmed by Bitcoin Depot's own breach notices and may reflect conflation of separate events.
What the Filing Doesn't Say
The 8-K leaves several critical questions unanswered: How were the credentials compromised? The filing says the attacker "obtained control of credentials associated with the Company's digital asset settlement accounts" but provides no detail on the attack vector — phishing, social engineering, supply chain compromise, insider threat, or something else entirely. Has any Bitcoin been recovered? Blockchain transactions are public. If law enforcement or the company's forensic team has traced the stolen funds, the filing doesn't mention it. What are the insurance coverage limits? The company says it "maintains insurance coverage that may cover certain losses associated with cybersecurity incidents" but offers no detail on coverage amounts or whether a claim has been filed. Did the leadership transition affect incident response? The breach was discovered March 23 — the same day Alex Holmes was appointed CEO and Chairman. Who actually led the incident response on Day One? Was the outgoing CEO Scott Buchanan still in the decision chain at all? Was Holmes briefed within hours of being sworn in? The filing is silent on this, and there is no public record of Holmes addressing the breach in any forum since.Context: A Company Under Siege
This cybersecurity breach lands on a company already dealing with an extraordinary volume of legal and regulatory pressure. Bitcoin Depot currently faces:- A Massachusetts Attorney General lawsuit (filed February 3, 2026) alleging consumer protection violations and securities fraud, with the AG claiming more than 80% of customers depositing $10,000 or more were scam victims
- An Iowa Attorney General consumer protection lawsuit against Bitcoin Depot and CoinFlip alleging a 94.92% scam rate on deposits of $10,000 or more
- A Missouri Attorney General Civil Investigative Demand issued in December 2024 as part of a multi-operator probe
- Pending litigation from Cash Cloud Inc. (DBA Coin Cloud) and an Ontario-based arbitration that resulted in an $18.5 million award against Bitcoin Depot
- Our ongoing investigative series on the company's compliance history — Part 1, Part 2, and Part 3 on the S-1 self-dealing architecture — documents roughly $90 million in insider-extraction patterns, a mass firing of compliance staff, and a related-party kiosk deal between the public company and founder Brandon Mintz's personal LLC
What This Means for Bitcoin Depot Customers
What customers should know:
- Your funds and data appear unaffected. The filing explicitly states the breach was contained to Bitcoin Depot's corporate IT environment and did not touch customer platforms, data, or systems
- No evidence of PII exposure — but the investigation is ongoing. Monitor the company's subsequent SEC filings for updates
- Your Bitcoin ATM transactions should be unaffected. The stolen Bitcoin came from internal settlement accounts, not customer-facing wallets
- If you have concerns, review our consumer protection resources for guidance on protecting your information
What This Means for Operators and Investors
For the broader Bitcoin ATM industry, this breach highlights a risk that doesn't get enough attention: the security of operators' own corporate treasury and settlement infrastructure. Bitcoin ATM operators hold significant amounts of Bitcoin in transit between customer transactions and exchange settlement. Those pools of funds are high-value targets. For Bitcoin Depot investors specifically, several things to watch:- Insurance recovery: The $3.665 million loss is material enough to disclose but may be partially or fully covered by cybersecurity insurance. Future filings should clarify the coverage outcome.
- Leadership stability: A CEO transition on the same day as a major breach, a General Counsel rehired seven days after that breach, and a retention bonus paid to keep the CFO in place together paint a picture of an organization under stress. Investors should watch whether the new leadership team stabilizes or whether further departures follow.
- Regulatory response: Given active investigations by multiple state attorneys general, this breach could trigger additional scrutiny from regulators examining Bitcoin Depot's operational controls.
- SEC scrutiny of the materiality timeline: The 14-day gap between discovery and materiality determination may draw questions about whether disclosure should have come sooner.
- S-1 implications: The recently filed S-1 registration statement will need to account for this incident. Potential investors in any new offering will weigh this breach alongside the company's existing legal exposure and the self-dealing architecture that Part 3 of our investigation documents.
- Outstanding liabilities: The $18.5 million Ontario arbitration award against the company, combined with a $3.7 million theft and multi-state AG litigation, creates a compounding financial risk picture that investors need to weigh carefully.
- Amendment filings: The 8-K explicitly states it may be amended as the investigation continues. Watch for follow-up disclosures under Item 1.05.