Bitcoin Depot Inc.

On March 23, 2026, Bitcoin Depot Inc. discovered unauthorized access to certain IT systems in which an actor obtained control of credentials associated with the Company's digital asset settlement accounts and transferred approximately 50.903 Bitcoin (~$3.665 million) from Company-controlled wallets. The Company believes the incident was contained to its corporate environment and did not affect customer platforms; no evidence of customer PII access identified. Materiality determined April 6, 2026.

Bitcoin Depot, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2025-07-08. 784 Massachusetts residents were affected.

Bitcoin Depot, Inc. notified Nebraska AG on July 7, 2025, of a data breach detected on June 23, 2024. An unauthorized individual accessed customer documents containing names, phone numbers, driver's license numbers, addresses, dates of birth, and emails. Bitcoin Depot engaged third-party experts and cooperated with law enforcement, which delayed notification until June 13, 2025. No misuse of information was detected. Remediation included enhanced security monitoring and awareness training.

Bitcoin Depot, Inc based in Atlanta, Georgia, a financial services entity reported a data breach to the Texas Attorney General. The breach was discovered on 2024-07-18 and reported on 2025-07-08. 1,683 Texas residents were affected. 26,732 individuals affected in total. Types of information involved: Name of individual;Address;Driver’s License number;Other;Date of Birth. Consumers were notified via U.S. Mail.

Bitcoin Depot Inc reported a data breach to the Indiana Attorney General. The breach occurred on 2024-06-09 and was reported on 2025-07-08. 4 Indiana residents were affected. 26,732 individuals affected in total.

Bitcoin Depot, Inc. notified 20 New Hampshire residents of a data security incident detected on June 23, 2024. Unauthorized access resulted in the exfiltration of customer names, phone numbers, driver's license numbers, and potentially addresses, DOBs, and emails. Notification was delayed at the request of federal law enforcement until June 13, 2025. Notices mailed July 8, 2025.

Bitcoin Depot, Inc. detected unusual activity on June 23, 2024, leading to an investigation that identified unauthorized access to customer personal information, including names, phone numbers, and driver's license numbers. The company engaged third-party experts and cooperated with federal law enforcement, which delayed notification until June 2025. Affected individuals are offered 12 months of credit monitoring and fraud assistance.

Bitcoin Depot, Inc. reported a malware/ransomware incident affecting 3,486 Washington residents. Unauthorized access occurred June 23-30, 2024. The company detected unusual activity on June 23, 2024, and engaged third-party experts. Notification was delayed at the request of federal law enforcement until June 13, 2025. Notices were sent July 7, 2025. Data involved names, phone numbers, DOB, and driver's license numbers.

Bitcoin Depot, Inc. reported an external system breach (hacking) on June 23, 2024, affecting 26,732 individuals, including 11 Maine residents. The incident exposed names, phone numbers, driver's license numbers, and potentially addresses, dates of birth, and emails. Notification was sent on July 8, 2025, after a delay due to a federal law enforcement investigation.

BITCOIN DEPOT, INC. filed a data-breach notice with the Illinois Attorney General in July 2025 (case 25-07-303). The register records the breach as discovered on June 23, 2024. Personal information types reported: drivers license. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

BITCOIN DEPOT, INC. filed a data-breach notice with the Illinois Attorney General in July 2025 (case 25-07-277). The register records the breach as discovered on July 18, 2024. Personal information types reported: drivers license. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.