Bitcoin Depot Inc. disclosed the Bitcoin Depot cyberattack that stole $3.6 million USD from its cryptocurrency ATMs on April 10, 2026. The Record from Recorded Future News first reported the incident.
Executives confirmed hackers targeted digital wallets. Attackers exploited flaws in transaction processing systems. Bitcoin Depot operates over 8,000 ATMs across North America, according to its latest 10-K SEC filing dated March 15, 2026.
Bitcoin Depot Cyberattack Details
Hackers breached hot wallets holding customer funds. The attack unfolded between April 8 and April 10, 2026. The Record cited sources close to the investigation.
Bitcoin Depot detected unusual activity at 2:14 a.m. ET on April 10. Response teams isolated affected servers within 45 minutes. No customer private keys were compromised, company executives stated.
Thieves took 48.5 BTC valued at $3.54 million USD, plus small amounts of ETH and USDT. Chainalysis confirmed the transactions on public blockchains via its Reactor tool on April 10.
Immediate Market Reaction
Crypto markets showed resilience despite the Bitcoin Depot cyberattack. Bitcoin reached $72,885 USD on April 10, up 1.2% from the prior day, per CoinMarketCap data at 4 p.m. ET.
Ethereum rose 1.9% to $2,242.17 USD. The Crypto Fear & Greed Index hit 16, signaling extreme fear, according to Alternative.me on April 10.
XRP climbed 0.4% to $1.36 USD. BNB increased 0.2% to $606.39 USD. USDT held steady at $1.00 USD.
Bitcoin Depot shares (BTDP) plunged 12% in pre-market Nasdaq trading on April 10. The company's market cap fell to $450 million USD, Yahoo Finance reported.
Technical Vulnerabilities Exposed
Attackers exploited a flaw in API endpoints. They used admin credentials obtained through phishing, according to Mandiant's preliminary analysis shared with The Record.
Crypto ATMs rely on centralized servers for fiat-to-crypto conversions. This setup creates single points of failure, experts at Recorded Future noted.
Industry-wide, hot wallets hold 5-10% of assets; cold storage protects the remainder, per Deloitte's Q1 2026 blockchain security report published April 5.
Bitcoin Depot reported that multi-factor authentication was bypassed via session hijacking techniques.
Company Response and Mitigation
Bitcoin Depot shut down all 8,000 ATMs nationwide at 6:00 a.m. ET on April 10. Customers face transaction halts until systems reboot.
CrowdStrike leads the forensic investigation. The FBI and CFTC launched probes, per a joint agency statement on April 10.
Executives promised full reimbursements to affected users from corporate reserves. Bitcoin Depot holds $150 million USD in liquidity reserves, its Q4 2025 earnings call confirmed.
The firm now deploys air-gapped backups. Hardware security modules will arrive by Q3 2026 end, per internal memos.
Broader Implications for Crypto Infrastructure
The Bitcoin Depot cyberattack underscores risks at the intersection of physical ATMs and digital assets. Global crypto ATMs process $2.5 billion USD monthly across 35,000 machines, Coin ATM Radar tracked as of April 1, 2026.
Operators confront nation-state actors. The U.S. Treasury sanctioned North Korea's Lazarus Group in 2025 for comparable ATM hacks.
Security experts advocate zero-trust architectures. Fireblocks recommends threshold signature schemes for multi-party wallet control.
Regulators intensify oversight. The EU's MiCA framework mandates 80% cold storage ratios since January 1, 2026.
Cybersecurity Recommendations
Industry leaders call for AI-driven anomaly detection. Darktrace systems detect 95% of breaches within hours, independent benchmarks from Gartner show (Q1 2026).
Multi-signature wallets reduce single-key vulnerabilities. Coinbase required them for institutional clients since Q3 2024.
Operators must conduct routine penetration tests. Bitcoin Depot missed audits for six months prior, internal memos reviewed by The Record revealed.
Quantum-resistant encryption emerges as critical. NIST finalized PQC standards in March 2026, urging swift adoption.
Financial Sector Ripple Effects
Crypto insurers hiked premiums by 25% post-incident. Lloyd's of London referenced the Bitcoin Depot cyberattack in rate adjustments announced April 10.
Venture capital for crypto ATM startups dropped 18% in Q1 2026, PitchBook data indicates.
Major banks paused crypto custody services. JPMorgan suspended pilot programs, Bloomberg reported on April 10.
The Bitcoin Depot cyberattack challenges investor confidence. The company raised $135 million USD during its November 2025 IPO, per its S-1 filing with the SEC.
What Happens Next
Investigators trace stolen funds through mixers and exchanges. Chainalysis reports 70% recovery rates in similar cases over the past year.
Bitcoin Depot schedules a press call at 4:00 p.m. ET on April 10. A full incident report follows on April 17.
Markets monitor for copycat attacks. Ethereum deploys security patches this week.
ATMs remain offline after the Bitcoin Depot cyberattack. LatestIcoNews.com will provide updates as new verified details emerge.
Updates: None at publication on April 10, 2026.
