2026 Bitcoin Depot — unauthorised access to settlement-account credentials; ~50.9 BTC moved out of company wallets
Data compromised
Company digital assets: about 50.903 BTC (about $3.67 million per the filing) transferred without authorisation from company-controlled wallets. The company says it has not identified evidence that customer personally identifiable information was accessed or exfiltrated, and that customer platforms and data were not affected.
Technical writeup
Item 1.05 Form 8-K dated April 6, 2026 (signed April 8). The company discovered the incident on March 23, 2026 and determined on April 6 that it was material, citing possible reputational harm and legal, regulatory and response costs. The filing says there has been no material operational impact so far, and the company will amend it as the investigation develops. This is a different incident from the 2025 California AG notice already on file for this company. recordsAffected 0.
Root cause
An unauthorised actor gained access to certain systems and obtained control of credentials associated with the company’s digital asset settlement accounts. The filing does not say how the credentials were obtained.