Loading story…
Bitcoin Depot disclosed that attackers breached parts of its corporate IT environment and stole 50.903 BTC—worth about $3.665 million—from company-controlled wallets after obtaining credentials tied to digital asset settlement accounts. The company said it detected suspicious activity on March 23, activated incident response procedures, brought in external cybersecurity experts, and notified law enforcement after the unauthorized transfers had already occurred.
The company reported that the intrusion was contained to its corporate systems and did not affect customer platforms, customer data, or other environments. Bitcoin Depot later determined the incident was material because of potential reputational, legal, regulatory, and response-related impacts, adding to broader scrutiny of security in the crypto ATM sector following earlier breaches involving Bitcoin Depot and rival operator Byte Federal.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Bitcoin Depot determined that the incident was material because of potential reputational, legal, regulatory, and response-related consequences. This assessment was disclosed in the company's SEC filing.
After identifying the incident, Bitcoin Depot activated its incident response procedures, brought in external cybersecurity experts, and notified law enforcement. The company also blocked the attackers' access after the credential compromise was identified.
On detecting suspicious activity, Bitcoin Depot discovered attackers had breached certain corporate IT systems, obtained credentials for digital asset settlement accounts, and transferred about 50.903 BTC worth roughly $3.665 million from company-controlled wallets. The company said the incident was limited to its corporate environment and did not affect customer platforms, systems, or data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Bitcoin Depot disclosed in an SEC filing that attackers accessed internal corporate systems and compromised credentials tied to the company’s digital asset settlement accounts, then transferred about **50.903 BTC** from company-controlled wallets, a loss the company valued at roughly **$3.665 million**. The company said the incident was discovered on March 23, involved its corporate environment, and had not shown evidence of access to customer platforms, customer systems, or customer information. Bitcoin Depot said it brought in external cybersecurity specialists, notified law enforcement, and did not expect immediate operational disruption while the investigation continues. Separate on-chain analysis linked the theft to **19 high-confidence addresses** that were reportedly active before the company’s detection date, suggesting the transfers may have begun earlier than initially identified. That analysis traced about **54.45 BTC** in related flows—more than the amount disclosed in the filing—and said roughly **54 BTC** ultimately moved to **KuCoin**, raising questions about whether additional accounts may have been affected. At the time of the analysis, the identified theft addresses reportedly had not yet been flagged in the analyst’s compliance tooling.
Jun 29, 2026
Bybit said attackers stole about **$1.5 billion in Ethereum** after taking control of one of the exchange’s wallets during a routine transfer from a cold wallet to a warm wallet, making the breach one of the largest digital thefts on record. The Dubai-based exchange said customer assets remained fully backed and pledged to reimburse affected users even if the cryptocurrency is not recovered, while the incident triggered more than **350,000 withdrawal requests** and briefly pushed Ethereum’s price down by nearly **4%**. Blockchain investigators at TRM Labs said the stolen funds came from one of Bybit’s offline cold wallets and assessed with **high confidence** that **North Korean hackers** were responsible, citing substantial overlaps between attacker-controlled addresses and wallets tied to earlier North Korean thefts. TRM tagged the compromised addresses under **`Bybit Exploiter Feb 2025`** and tracked the assets in real time, while Bybit offered a **10% bounty** to cybersecurity and crypto-analytics experts who can help trace and recover the stolen funds.
Aug 15, 2026
Cryptocurrency exchange **Bitget** confirmed that attackers stole approximately **$351.6 million** after gaining unauthorized access to part of its wallet infrastructure. The exchange detected unauthorized hot-wallet transfers at 18:31 UTC on September 24 and suspended withdrawals across its platform while it investigated with law enforcement and blockchain-security firms. Bitget CEO Gracy Chen said the incident was a direct breach of company systems or servers and said the exchange suspects North Korea-linked **Lazarus Group**, although it has not released technical evidence supporting the attribution. On-chain analysts initially observed roughly $165 million in ETH, stablecoins, and Tether Gold moving from Bitget-labeled wallets to a single externally owned address across Ethereum, Arbitrum, Optimism, and Base; the recipient later forwarded 19.67 million USDT0 received on Arbitrum. Bitget said deposits and trading remain available, customer balances are accurate, and its cold wallets and user private keys were not affected. It stated that its User Protection Fund, valued above $464 million, can cover the loss and pledged to publish a full incident report within 24 hours.
Oct 2, 2026