Bitcoin Depot Discloses $3.6M BTC Theft After Hack on Settlement Accounts

• Bitcoin Depot disclosed that hackers stole 50.9 BTC, worth about $3.665 million, in a March 23 security breach.
• The attackers gained access to internal systems and used settlement account credentials to move company-held bitcoin without authorization.

Bitcoin Depot has disclosed a corporate hack that resulted in the theft of roughly $3.6 million in bitcoin, adding another reminder that operational infrastructure, not just customer wallets, remains a weak point in crypto security.

In an SEC filing on Wednesday, the Bitcoin ATM operator said attackers gained access to its IT systems on March 23 and obtained credentials tied to digital asset settlement accounts. That access allowed them to move 50.9 BTC from company-controlled wallets without authorization.

Settlement credentials became the entry point

The detail that stands out is not only the size of the loss, though 50.9 BTC is hardly minor. It is where the attackers got in. By compromising settlement account credentials, they appear to have targeted the part of the business that handles internal asset movement and operational liquidity rather than a more visible consumer-facing system.

That matters because settlement infrastructure tends to sit quietly in the background until something goes wrong. For firms operating large networks of crypto-linked services, including ATM providers, those accounts are often central to day-to-day functioning. If they are exposed, the damage can move quickly.

Bitcoin Depot said the stolen amount was valued at about $3.665 million. The breach was disclosed roughly two weeks after the incident itself, suggesting the company spent at least part of that period assessing scope, tracing access and preparing its formal reporting.

Corporate crypto operations stay in the crosshairs

The incident also underlines a broader pattern in the market. As the crypto sector matures, attackers are not only chasing retail holders or decentralized protocols. They are increasingly going after companies that sit in the middle of transaction flow, custody, settlement and payments.

For Bitcoin Depot, the immediate issue is the loss itself. The harder question is whether the breach was isolated to a narrow set of credentials or exposed a deeper weakness in internal controls. That distinction tends to shape what comes next, from regulatory scrutiny to how much confidence counterparties and users retain in the platform’s operating systems.