Bitcoin Depot Discloses $3.7 Million Corporate Hack After Attackers Drain 50.9 BTC

Bitcoin Depot Inc. disclosed in an SEC filing that hackers stole 50.9 BTC worth $3.665 million from company-controlled wallets on March 23, 2024, after gaining access to IT systems and obtaining credentials for digital asset settlement accounts. The crypto ATM operator emphasized that customer-facing platforms and user data remained unaffected, and activated incident response protocols including engaging external cybersecurity experts and notifying law enforcement. The breach highlights growing security challenges for Bitcoin ATM operators who must maintain significant cryptocurrency reserves to facilitate transactions, making them attractive targets for cybercriminals. This marks Bitcoin Depot's second major security incident following a 2023 breach affecting 58,000 users, contributing to a 44% stock decline over 30 days despite a 15% intraday spike following the disclosure.

March 23 security breach and theft of 50.9 BTC

• ▪Bitcoin Depot Inc. disclosed that hackers stole approximately 50.9 BTC valued at $3.665 million from company-controlled wallets in a March 23, 2024 security breach
• ▪Bitcoin Depot Inc. disclosed the March 23 security breach in an SEC filing on Wednesday
• ▪The attackers transferred cryptocurrency from Bitcoin Depot Inc. without authorization during the March 23 breach
• ▪Hackers obtained credentials for Bitcoin Depot Inc.'s digital asset settlement accounts during the March 23 breach
• ▪Attackers gained access to Bitcoin Depot Inc.'s IT systems during the March 23 breach

Company response and impact assessment

• ▪Bitcoin Depot Inc. shares are down 44% over the last 30 days
• ▪Bitcoin Depot Inc. activated its incident response protocols following discovery of the March 23 breach
• ▪Bitcoin Depot Inc. shares spiked 15% during the trading day to finish at a price of $2.74
• ▪Bitcoin Depot Inc. engaged external cybersecurity experts to investigate the attack vector and secure remaining assets after the March 23 breach
• ▪Bitcoin Depot Inc. notified law enforcement authorities about the March 23 breach
• ▪Bitcoin Depot Inc. classified the March 23 incident as material to its operations
• ▪Bitcoin Depot Inc. stated that its customer-facing platforms remained unaffected by the March 23 intrusion
• ▪Bitcoin Depot Inc. recorded a preliminary loss estimate of $3.665 million based on Bitcoin's value at the time of the March 23 theft

Broader security challenges facing Bitcoin ATM operators

• ▪Bitcoin Depot Inc. experienced a 2023 breach where hackers accessed personal data for 58,000 users

Perspective of Bitcoin Depot Inc.

• ▪Bitcoin Depot Inc. maintains that the March 23 breach was isolated to corporate settlement accounts rather than customer-facing systems
• ▪Bitcoin Depot Inc. characterized its response to the March 23 breach as swift and comprehensive through engagement of external experts and law enforcement

Perspective of Cybersecurity experts

• ▪Bitcoin Depot's March 23 breach illustrates the credential compromise risks inherent in systems that bridge physical cash infrastructure with digital asset custody
• ▪The March 23 Bitcoin Depot breach demonstrates how crypto ATM operators' need to maintain large cryptocurrency reserves creates concentrated targets for sophisticated attackers

Perspective of Investors

• ▪Bitcoin Depot's 44% stock decline over 30 days reflects investor concerns about recurring security failures following both the 2023 and March 2024 breaches
• ▪The 15% intraday spike in Bitcoin Depot shares following the breach disclosure suggests some investors viewed the $3.665 million loss as manageable relative to company operations