Bitcoin Depot Inc. reportedly failed to spot a data breach that resulted in the loss of over 50 bitcoins (BTC) worth $3.7 million for three days.
The BTC ATM operator disclosed the loss of 50.9 BTC in an SEC filing earlier this week, stating that the attacker gained access to its IT systems and its digital asset settlement accounts on March 23.
This, it says, allowed them to move the BTC from company-controlled wallets.
However, according to subsequent research from onchain sleuth ZachXBT, the breach actually occurred three days earlier on March 20.
“On April 6, 2026 Bitcoin Depot disclosed in an SEC 8K filing it uncovered an incident on March 23, 2026 which resulted in 50.9 BTC ($3.6M) stolen,” wrote Zach on Telegram.
“However the report did not include theft addresses so I manually traced out the incident onchain and found 19 high confidence theft addresses from March 20.
“This means it took three days for Bitcoin Depot to notice the funds were missing from its business.”
Read more: Inside the $280M Drift hack: weeks of setup, minutes to drain
Zach continued, “A delta of 3.55 BTC (54.45 BTC total) vs 50.9 BTC reported was found indicating other employee personal accounts may have also been impacted.
“54 BTC ($3.7M) flowed to KuCoin, a crypto exchange increasingly used by illicit actors.
“At the time of my post the theft addresses still have not been reported in any compliance tools I use.”
According to the SEC filing, Bitcoin Depot is continuing to investigate the nature and scope of the incident with the assistance of unnamed “third-party specialists.”
It also says it’s “working with its outside cybersecurity experts to further reinforce its information technology systems and to prevent future unauthorized access.”
It also reassures users that no customer personally identifiable information was accessed, but does add that the “investigation remains ongoing.”
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.
Source: https://protos.com/bitcoin-depot-didnt-spot-50-btc-hack-for-three-days-report/
