Hackers stole $3.6 million USD in the Bitcoin Depot cyberattack. The company spotted the breach on April 11, 2026. Bitcoin Depot runs over 8,000 crypto ATMs across North America.
Cybercriminals made unauthorized transactions to steal the funds. Bitcoin Depot notified authorities and paused affected services. This attack ranks among the largest on crypto ATM networks this year.
How Hackers Breached Bitcoin Depot
Attackers found a flaw in Bitcoin Depot's cloud-based transaction system. Cloud systems store and process data online for fast access. Recorded Future News reported that hackers sent phishing emails on April 10, 2026.
Phishing emails trick people into clicking bad links. Those links install malware. The malware allowed hackers to steal funds over several hours. The theft totaled 49.5 BTC at $72,660 USD per Bitcoin, per CoinMarketCap on April 11, 2026.
Hackers targeted hot wallets tied to some ATMs. Hot wallets hold crypto online for quick trades. Attackers find them easier to hit than offline cold wallets. Security firm Mandiant now investigates. The attack traced to an IP address in Eastern Europe. Firewalls failed to stop hackers from moving inside the network.
Bitcoin Depot's Quick Response
Bitcoin Depot halted all U.S. ATM operations at 10:00 AM ET on April 11, 2026. The company cut hacked servers to limit damage. It emailed customers about possible risks.
Leaders plan to repay users from $150 million USD in cash reserves, per the Q1 2026 balance sheet. Experts now audit the systems. Shares (NASDAQ: BTBT) fell 12% pre-market, Bloomberg analysts reported.
Bitcoin Depot scheduled a press conference for 2:00 PM ET that day.
Market Reactions to the Cyberattack
The Crypto Fear & Greed Index dropped to 15, signaling extreme fear among traders, per alternative.me on April 11, 2026. Bitcoin rose 1.4% to $72,660 USD. Ethereum gained 2.1% to $2,233.83 USD.
USDT held steady at $1.00 USD. BNB climbed 0.8% to $606.04 USD. XRP rose 0.4% to $1.35 USD. Major coins stayed firm despite the news.
Trading volume in related tokens surged 25% on decentralized exchanges. Investors worry about risks to rivals like General Bytes. Regulators consider tougher rules.
Why Crypto ATMs Face Risks
U.S. crypto ATMs process over $1 billion USD monthly, Ark Invest estimated in March 2026. They link to the cloud for instant payments. Hackers target weak login checks on those links.
Bitcoin Depot used multi-signature wallets that require multiple approvals. Weak spots still allowed entry. Chainalysis found 70% of 2025 crypto thefts stemmed from cloud setup errors. Fintech firms often pick speed over strong defenses.
Hackers laundered funds through mixers. Mixers blend stolen crypto to hide trails, like Tornado Cash copies.
Cloud Flaws Spark Security Push
AWS and similar clouds hold 60% of fintech data, Gartner reported in Q1 2026. Bitcoin Depot used AWS S3 buckets for backups. Attackers scanned them and grabbed access keys from loose settings.
Experts push zero-trust setups. Zero-trust denies automatic access to any user or device. Firms should use endpoint tools from CrowdStrike to detect threats. Regular hack tests catch phishing early.
Bitcoin Depot plans hardware security modules (HSMs) for key storage. HSMs work offline. Cloud providers offer blockchain-ready HSMs.
Regulators and Rivals React
The U.S. Secret Service launched a probe on April 11, 2026. FinCEN requires reports on thefts over $10,000 USD within 24 hours. Bitcoin Depot filed on time.
Rival Coinhub strengthened checks. The Crypto ATM Alliance seeks uniform security rules. It represents 90% of U.S. machines.
EU officials watch closely after last year's attacks. FATF global rules may tighten ID checks for ATMs.
Steps for Users and Businesses
Bitcoin Depot users should check accounts for odd activity. Enable two-factor authentication. Avoid public Wi-Fi for crypto deals.
Fees may rise as firms add security costs. Spread holdings on insured exchanges. Use Ledger hardware wallets for safety.
Businesses must review cloud settings every quarter. Buy AI threat tools from Darktrace. Strong security builds trust.
The Bitcoin Depot cyberattack boosts interest in decentralized finance (DeFi). DeFi skips central wallets that hackers target. Bitcoin Depot shares its recovery plan today.
