Bitcoin Depot Missed 50 BTC Hack for Three Days, On-Chain Sleuth Reveals

Bitcoin Depot, a major BTC ATM operator, failed to detect a multi-million dollar hack for three days, according to on-chain analysis. The company disclosed a breach on March 23, 2026, resulting in the theft of 50.9 BTC worth approximately $3.7 million from its digital asset settlement accounts. However, independent research by investigator ZachXBT reveals the actual theft occurred on March 20, indicating a critical three-day gap in the company's security monitoring and incident response.

In an SEC 8-K filing, Bitcoin Depot stated an attacker gained access to its IT systems and company-controlled wallets on March 23. ZachXBT, after manually tracing the incident on-chain due to the lack of disclosed theft addresses in the report, identified 19 high-confidence theft addresses linked to the breach from March 20. This discrepancy suggests the company's internal detection mechanisms were insufficient, allowing the attacker to operate undetected for 72 hours after the funds were moved.

The incident exposes significant operational vulnerabilities in a publicly traded company's digital asset custody and internal controls. The delay in detection raises serious questions about the robustness of real-time transaction monitoring and wallet security protocols within the crypto ATM sector. For investors and regulators, the event underscores the persistent risks associated with corporate treasury management in cryptocurrency, where delayed discovery can amplify losses and complicate recovery efforts.