Bitcoin Depot Hack May Be Bigger Than Reported, Says ZachXBT

• Bitcoin Depot files an SEC report confirming theft of 50.9 BTC worth around $3.6 million.
• ZachXBT says Bitcoin Depot breach may be larger, tracing ~54 BTC vs reported 50 BTC. 
• Stolen Bitcoin tracked to KuCoin exchange with wallet addresses not yet flagged in compliance tools.

Crypto ATM operator Bitcoin Depot has reported a security breach that led to the theft of more than 50 Bitcoin, worth around $3.6 million, according to a filing with the U.S. Securities and Exchange Commission.

The company said it discovered the incident on March 23, when an unauthorized party gained access to its systems and transferred funds from company-controlled wallets.

However, blockchain investigator ZachXBT said the situation may be more serious than initially reported.

Funds Traced On-chain

According to ZachXBT, the company did not include wallet addresses linked to the theft in its report. He said he manually tracked the activity on the blockchain and identified 19 suspected addresses tied to the incident as early as March 20.

This, he says, could mean that the funds may have been moved several days before the company detected the breach. “It took three days for Bitcoin Depot to notice the funds were missing,” he said.

Possible Higher Losses

ZachXBT also pointed out a mismatch in the numbers.

While the company reported a loss of about 50.9 BTC, his findings suggest the total movement could be closer to 54 BTC. This difference raises the possibility that other accounts, including employee-linked wallets, may also have been affected.

Funds Moved to Exchange

The stolen Bitcoin was traced to KuCoin, a crypto exchange that has been flagged in the past for handling funds linked to illicit activity.

At the time of his analysis, ZachXBT said the wallet addresses involved had not yet been flagged in the compliance tools he uses, which could make tracking and recovery more difficult.

Company Response And Outlook

Bitcoin Depot said the breach was limited to its internal systems and did not affect customer accounts or personal data. The company has launched an investigation and is working with cybersecurity experts and law enforcement.

Financially, the company reported a net income of $4.7 million in 2025, down from $7.8 million the previous year. It also expects its core business revenue to drop by 30% to 40% in 2026 due to tighter regulations and compliance requirements.

The incident comes shortly after a leadership change, with Alex Holmes, former CEO of MoneyGram, taking over as chairman and CEO.

Related: Bitcoin Depot Operations Halted in Connecticut Over Compliance Violations