Loading story…
Bitcoin Depot disclosed in an SEC filing that attackers accessed internal corporate systems and compromised credentials tied to the company’s digital asset settlement accounts, then transferred about 50.903 BTC from company-controlled wallets, a loss the company valued at roughly $3.665 million. The company said the incident was discovered on March 23, involved its corporate environment, and had not shown evidence of access to customer platforms, customer systems, or customer information. Bitcoin Depot said it brought in external cybersecurity specialists, notified law enforcement, and did not expect immediate operational disruption while the investigation continues.
Separate on-chain analysis linked the theft to 19 high-confidence addresses that were reportedly active before the company’s detection date, suggesting the transfers may have begun earlier than initially identified. That analysis traced about 54.45 BTC in related flows—more than the amount disclosed in the filing—and said roughly 54 BTC ultimately moved to KuCoin, raising questions about whether additional accounts may have been affected. At the time of the analysis, the identified theft addresses reportedly had not yet been flagged in the analyst’s compliance tooling.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Bitcoin Depot disclosed the incident in an SEC 8-K filing on April 6, stating that the attack appeared limited to its corporate environment and that it had found no evidence customer platforms, systems, or customer information were accessed or exfiltrated. The company said it engaged external cybersecurity experts, notified law enforcement, and continued investigating the incident.
Bitcoin Depot said it discovered a cyberattack on March 23 in which a threat actor accessed certain internal systems, took control of credentials tied to its digital asset settlement accounts, and transferred about 50.903 BTC from company-controlled wallets. The stolen cryptocurrency was valued at roughly $3.6 million at the time of reporting.
On-chain tracing cited in later analysis identified 19 high-confidence theft addresses active on March 20, suggesting the wallet theft activity linked to Bitcoin Depot may have started before the company detected the incident. The same analysis said about 54.45 BTC was observed moving through traced flows, with roughly 54 BTC ultimately reaching KuCoin.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Bitcoin Depot disclosed that attackers breached parts of its corporate IT environment and stole **50.903 BTC**—worth about **$3.665 million**—from company-controlled wallets after obtaining credentials tied to digital asset settlement accounts. The company said it detected suspicious activity on March 23, activated incident response procedures, brought in external cybersecurity experts, and notified law enforcement after the unauthorized transfers had already occurred. The company reported that the intrusion was contained to its corporate systems and did **not** affect customer platforms, customer data, or other environments. Bitcoin Depot later determined the incident was material because of potential reputational, legal, regulatory, and response-related impacts, adding to broader scrutiny of security in the crypto ATM sector following earlier breaches involving Bitcoin Depot and rival operator Byte Federal.
Jun 29, 2026
Bybit said attackers stole about **$1.5 billion in Ethereum** after taking control of one of the exchange’s wallets during a routine transfer from a cold wallet to a warm wallet, making the breach one of the largest digital thefts on record. The Dubai-based exchange said customer assets remained fully backed and pledged to reimburse affected users even if the cryptocurrency is not recovered, while the incident triggered more than **350,000 withdrawal requests** and briefly pushed Ethereum’s price down by nearly **4%**. Blockchain investigators at TRM Labs said the stolen funds came from one of Bybit’s offline cold wallets and assessed with **high confidence** that **North Korean hackers** were responsible, citing substantial overlaps between attacker-controlled addresses and wallets tied to earlier North Korean thefts. TRM tagged the compromised addresses under **`Bybit Exploiter Feb 2025`** and tracked the assets in real time, while Bybit offered a **10% bounty** to cybersecurity and crypto-analytics experts who can help trace and recover the stolen funds.
Aug 15, 2026
Coinbase confirmed an **insider data breach** in which a single contractor improperly accessed customer information affecting approximately **30 customers**. Coinbase said its security team detected the activity, the contractor no longer provides services to the company, impacted users were notified, and **identity theft protection** was offered; Coinbase also reported the incident to relevant regulators. The disclosure followed brief Telegram posts by threat actors showing screenshots of an internal **Coinbase support interface** that appeared to expose access to sensitive customer data, including **names, email addresses, phone numbers, dates of birth, and KYC information** (and, per the leaked interface screenshots, potentially wallet balances and transaction details). Reporting indicated the incident is **separate from the previously disclosed TaskUs-related insider breach**, and it remains unclear whether the group that posted the screenshots (reported as **“Scattered Lapsus Hunters”**) conducted the access or merely obtained and shared the data; the incident highlights ongoing targeting of **BPO/contractor ecosystems** due to their privileged access to internal tools and customer records.
Jun 29, 2026