Bitcoin Depot Confirms Data Breach Affecting 27,000 Customers

Bitcoin Depot, the largest Bitcoin ATM operator in North America, has confirmed a data breach that exposed sensitive personal information belonging to approximately 27,000 individuals.

The breach, which occurred in June 2024, remained undisclosed until now due to an active federal investigation.

Delayed Disclosure Tied to Law Enforcement Request

In a letter sent to affected customers, Bitcoin Depot stated that it first detected suspicious activity on its network on June 23, 2024. An internal investigation concluded on July 18, 2024, but a parallel probe by an unnamed federal agency required the company to delay public notification.

“On July 18, 2024, our investigation was completed. We determined that your personal data was included in documents related to some of our customers that were accessed without authorization,” the company wrote.
“Unfortunately, we could not notify you earlier due to the ongoing investigation. Federal law enforcement asked Bitcoin Depot to wait until its conclusion before sending out notifications.”

What Data Was Exposed?

The type of data compromised varies by individual but may include:

• Full name
• Phone number
• Driver’s license number
• Home address
• Date of birth
• Email address

In short, the breach likely exposed key elements of customer information typically collected as part of KYC (Know Your Customer) compliance. Under U.S. law, cryptocurrency companies are required by the Financial Crimes Enforcement Network (FinCEN) to collect this data as part of anti-money laundering protocols.

No Identity Theft Protection Offered

Unlike traditional breaches involving banks or credit card providers, Bitcoin Depot is not offering standard identity theft protection or credit monitoring services to affected users. Instead, the company advises customers to:

• Remain vigilant
• Monitor financial accounts and activity
• Consider freezing accounts or credit reports if suspicious behavior is detected

What Happens Next?

While Bitcoin Depot has not disclosed technical details of the breach or who may be responsible, the incident underscores the unique privacy and security challenges facing cryptocurrency services, particularly those that handle large-scale, in-person transactions via ATMs.

The company has not commented on whether additional security measures will be implemented in the wake of the breach.