California Orders CoinFlip to Pay $4.8 Million to Scam Victims and Return $350,000 in Excess Fees

California's Department of Financial Protection and Innovation (DFPI) has ordered CoinFlip to pay more than $4.8 million to California scam victims. DFPI says CoinFlip broke state and federal law by accepting more than $1,000 in a single day from kiosk customers, charging excessive fees, skipping required pre-transaction written disclosures, and issuing receipts without legally required information. The regulator announced the order on November 4, 2026, and says the payment "secures full compensation for the victims."

DFPI directed the bulk of the money to people who lost funds through CoinFlip kiosks, not to the state treasury. A separate payment of more than $350,000 to DFPI covers fees the regulator says CoinFlip "illegally charged California consumers." DFPI also ordered the company to immediately cease all unlawful, unfair, deceptive, or abusive acts or practices.

DFPI says failures in customer identification and suspicious-activity controls enabled scams; its release does not explain how it calculated the $4.8 million victim payment.

DFPI cites identity-control failures since 2021 and violations of later kiosk rules

According to the press release, a DFPI investigation found that since 2021 CoinFlip "has failed to appropriately identify who uses its products and services and failed to detect, prevent, report, and mitigate suspicious activity in its systems, enabling scammers to exploit kiosk users and drain their assets." The specific kiosk violations fall into four categories:

DFPI says the conduct violated three bodies of law: California's Digital Financial Assets Law (DFAL), the California Consumer Financial Protection Law (CCFPL), and federal anti-money laundering (AML) laws, the rules requiring financial firms to verify customers and flag suspicious transactions.

Dates matter here. California's kiosk rules phased in, so the 2021 start date does not cover all four violations. The 2021 finding concerns customer identification and suspicious-activity controls, which DFPI connects partly to federal AML law.

Under the statute, the $1,000 daily limit has applied since January 1, 2024. Since January 1, 2025, charges on a single transaction may not exceed the greater of $5 or 15% of the U.S.-dollar value of the digital assets involved. Also since January 1, 2025, operators must give a written pre-transaction disclosure covering the asset amount, operator fees, and a warning if transactions cannot be reversed or refunded. Receipts, required since January 1, 2024, must carry the customer and operator names, transaction date and time, asset and dollar amounts, fees, and the price spread.

Regulators describe a machine built for irreversible losses

DFPI's announcement explains why these kiosks attract fraudsters. The machines sit in grocery stores, gas stations and convenience stores, and transactions "are immediate, cannot be reversed, and are difficult for consumers to trace."

That combination, DFPI wrote, makes crypto ATMs "prime tools for scammers to defraud individuals, particularly older adults." A daily cap, a clear fee disclosure and a complete receipt are the friction points California built into its law to interrupt that sequence. DFPI says CoinFlip's machines lacked some of that friction.

California Business and Consumer Services Secretary Rohit Chopra, the former federal Consumer Financial Protection Bureau director, framed the action against the federal backdrop: "With no federal consumer protection, California is stepping up to hold accountable companies that leverage technology to harm hardworking families."

Restitution isn't new for DFPI, but this order is roughly 45 times larger

DFPI structured the order with two separate payments, and they should not be added together into a single "fine." The $4.8 million is designated for California victims. The $350,000-plus covers excessive fees and is payable to DFPI. The release does not describe a separate civil penalty.

California has ordered kiosk restitution before. DFPI's June 2025 consent order required Coinme to pay $51,700 in restitution directly to specified California consumers within 10 business days of the order's effective date, alongside a $300,000 administrative penalty that the restitution is credited toward. Coinhub's October 2025 consent order provides for up to $105,000 in restitution to consumers charged more than the allowed fees, plus a $675,000 administrative penalty. The CoinFlip victim payment is roughly 45 times the Coinhub ceiling. The release also lists earlier actions that shut down Hermes Bitcoin and fined RockItCoin, Coinme and Coinhub.

The roughly 45-fold difference makes victim compensation a potential balance-sheet exposure for kiosk operators. DFPI has not announced a policy of sizing orders by victim losses, however, and the release does not explain how it reached $4.8 million. One order does not establish a pattern.

The release leaves consent, victim counts and monitoring unstated

Mohseni calls it "Today's order," and nothing in the release describes it as proposed or pending. Beyond the cease-and-desist directive, though, the announcement is thin on terms.

DFPI's release does not specify whether the order requires monitoring or independent review. The underlying order is needed to establish its operational terms. By comparison, the Coinme and Coinhub consent orders each require compliance policy changes and periodic reports for up to one year or until the company stops operating California Bitcoin ATMs. CoinFlip's public news page lists announcements through June 10, 2026 and shows no response to the California order.

CoinFlip adds 20 kiosks across three states over 30 days; California listings are down 31% since January

DFPI quotes CoinFlip's description of itself as the "world's largest network of cryptocurrency ATMs by transaction volume." According to BitcoinATM.news's archive of CoinATMRadar listings, CoinFlip's national count fell from 4,265 kiosks on January 21, 2026 to 3,879 on November 5, 2026, a 9% decline.

Across California, Washington and Missouri combined, our tracker records 23 CoinFlip installs and three removals in the past 30 days. Our location tracker, which combines CoinATMRadar listings with operator feeds, shows 700 active CoinFlip kiosks across the three states, a net gain of 20.

California's overall market has contracted far faster. Listings fell from 1,953 on January 21 to 1,338 on November 5, a 31% drop (615 fewer machines). Athena Bitcoin (168 to 0) and GetCoins (45 to 0) removed their entire state networks, and loko crypto fell from 285 to 39. The contraction overlapped with California's kiosk rules, but our data does not show why individual operators left.

Washington's case against CoinFlip and its CEO remains a proposal

On August 26, 2026, Washington's Department of Financial Institutions issued Statement of Charges C-26-4341-26-SC01 against CoinFlip parent GPD Holdings LLC and CEO Benjamin Weiss. The filing seeks to revoke CoinFlip's Washington license, bar the company and Weiss for 10 years, and impose a $1,029,600 fine, along with refunds (our coverage). Those are allegations and requested remedies, not final findings. DFI's September 3 release said CoinFlip and its responsible individual had the right to request a hearing to contest the charges, and DFI's enforcement listings still show the matter as a Statement of Charges.

Washington's proposed sanctions against Weiss are the only individual-accountability element across the two states. California's order, as announced, runs against the company, and DFPI does not say it coordinated with Washington or any other state.

CoinFlip's record also includes resolved 2024 consent orders with the Minnesota Department of Commerce and the Texas Department of Banking. The company carries an F grade in our compliance database.

DFPI urges scam victims to file complaints

DFPI has not published eligibility criteria, a claims process or a payment timeline for the $4.8 million. It also does not say whether victims must apply or will be contacted. Californians who lost money through a CoinFlip kiosk should submit a complaint to DFPI, which the regulator urges scam victims to do.

DFPI's Crypto Scam Tracker lists active schemes. Our consumer protection resources explain how to document a kiosk loss.