Bitcoin Depot

Credential Compromise

Estimated loss

$3.67M

VERDICT —OUT OF SCOPE

Root cause is private-key / signer compromise — the on-chain contract behaved exactly as written. No pre-deployment source audit or bytecode review reaches the key-custody perimeter; this is operational-security territory (HSM/MPC hygiene, key rotation, hot-wallet isolation). Bytecode would show nothing wrong.

▰ METHOD

PRIVATE KEY

PRIVATE-KEY

Root cause

Root-cause analysis not yet published. The incident description below contains all currently available signal — review the attack transaction directly for definitive forensics.

Forensic narrative

According to Decrypt, Bitcoin ATM operator Bitcoin Depot disclosed in a filing with the U.S. Securities and Exchange Commission that it experienced a security breach on March 23. Approximately 50.9 BTC, valued at around $3.665 million, was stolen by attackers. The hackers infiltrated the company’s IT systems and obtained credentials for its digital asset settlement accounts, enabling unauthorized fund transfers. Bitcoin Depot stated that it has activated its incident response procedures, engaged external cybersecurity experts to investigate the attack vector and secure remaining assets, and notified law enforcement authorities. The company also noted that its customer platform and user data were not affected by the breach. Attack method (per SlowMist): Credential Compromise. Reported loss: $ 3,665,000.

Primary source

https://decrypt.co/363734/bitcoin-depot-atm-operator-3-6-million-btc-stolen-security-breach ↗

Sourced from

slowmist

Technical record