April 6, 2026: Bitcoin Depot, the operator of cryptocurrency kiosks in the United States, told the SEC that an unauthorised actor had gained control of credentials for its digital-asset settlement accounts. About 50.903 BTC was transferred out of company-controlled wallets, which the filing values at about $3.67 million. Canonical: bitcoin-depot-settlement-wallets2026. Primary source: Bitcoin Depot's Form 8-K dated April 6, 2026.
The incident concerns the company's own digital assets, not the balances of individual customers. The filing is explicit on that point, and the difference matters for anyone who uses a Bitcoin Depot kiosk. It is also a different incident from the 2025 California Attorney General notice already on file for the company, which is catalogued separately as bitcoin-depot-inc-2025-ca-20250707.
What happened
- March 23, 2026: Bitcoin Depot discovered the incident, according to the filing.
- April 6, 2026: the company determined that the incident was material. It cited possible reputational harm and legal, regulatory and response costs.
- April 8, 2026: the 8-K was signed. Its date, April 6, is the date used in the catalog.
The filing says there has been no material operational impact so far. It also says the company will amend the filing as the investigation develops, so later figures may change.
Technical analysis
The filing says an unauthorised actor gained access to certain systems and obtained control of credentials associated with the digital-asset settlement accounts. It does not say how the credentials were obtained. Once the actor controlled those credentials, digital assets could be moved out of company-controlled wallets. The company has not described the attacker or the route in more detail, and this article does not speculate on either.
Verified vs unknown
- Verified (company 8-K): unauthorised access to systems, control of settlement-account credentials, the transfer of about 50.903 BTC (about $3.67 million per the filing), the March 23 discovery date, and the statement that no evidence has been found that customer personal information was accessed or taken. The filing also states that customer platforms and data were not affected.
- Not disclosed: how the credentials were obtained, who is responsible, whether any funds have been recovered, and whether the amended filing will change any figure.
Who is affected
On the company's account, the direct loss fell on the company, not on customers. Customers who use Bitcoin Depot kiosks are not named as affected by this filing. That is an important caveat, not a guarantee: the company's own investigation is still open, and the filing says it will update readers as facts change. Customers should still assume that a company which has lost control of credentials may also be a target for impersonation.
What to do
- Treat unexpected messages about a Bitcoin Depot account, refund or identity check as suspicious. Open the official site yourself rather than following a link.
- Keep your transaction receipts and compare any unfamiliar transaction against them. A receipt that does not match a charge is a reason to contact the company through its official channels.
- If you have an online account, change the password and enable two-factor authentication if it is offered.
- Never send cryptocurrency to someone who asks you to move, secure or verify your funds. Requests like that are one of the most common scams that follow stories about crypto ATMs.
- Watch for the amended 8-K. The company has said it will update the filing, and that update is the place to check for new figures.
How to read the filing
An Item 1.05 Form 8-K is the SEC form a public company uses to disclose a cybersecurity incident that it has determined to be material. The filing is therefore the company's formal statement rather than a press story, and the company updates it by amending the form. Two dates matter here: the date the company found the incident and the date it decided the incident was material. The gap between them covers the time the company spent assessing the incident before it reached that decision.
The filing also gives reasons for the materiality decision, including possible reputational harm and legal, regulatory and response costs. Those are the company's own words. They show what the company considered at stake, not a measure of harm to any individual.
What is not yet known
The filing does not say how the credentials were obtained, whether the transferred digital assets have been traced or recovered, or whether the attacker has been identified. Each of those points would change the picture for the company's counterparties, and the amendment is where the company has said it will provide them.
Related reading
For another wallet-related incident where the risk was to users' keys and funds, see the Bitget wallet theft. The lesson in both cases is that control of an account or device is what turns a breach into a loss.
Sources
- Bitcoin Depot Form 8-K (Item 1.05), April 6, 2026
- Catalog row: bitcoin-depot-settlement-wallets2026
- Earlier, separate California notice: bitcoin-depot-inc-2025-ca-20250707