Blockchain sleuth ZachXBT says it took three days for the Bitcoin ATM firm to notice the funds were missing from its business.
ZachXBT, a well-known crypto sleuth, traced a $3.7 million theft from Bitcoin Depot, one of the largest Bitcoin ATM networks running Bitcoin machines across the U.S. and Canada, saying it took the form three days to notice the missing funds.
In a Telegram post on Thursday, April 9, the investigator wrote he manually traced on a blockchain “19 high confidence theft addresses from March 20” and added, “This means it took three days for BitcoinDepot to notice the funds were missing from its business.” ZachXBT further said:
“A delta of 3.55 BTC▲$64,524.00 (54.45 BTC total) vs 50.9 BTC reported was found indicating other employee personal accounts may have also been impacted.”
The investigator also found that all the stolen BTC ended up on KuCoin, a crypto exchange ZachXBT said is “increasingly used by illicit actors.”
The crypto ATM company revealed in an SEC filing on April 6 that it spotted the breach on March 23 and filed a cybersecurity incident report. The attacker got hold of credentials tied to its “digital asset settlement accounts” and transferred 50.9 BTC, worth roughly $3.7 million, the filing reads.
Despite the incident, Bitcoin Depot shares rose 15.6% on Wednesday to $2.74, per data from Google Finance.
Bitcoin ATM Market Faces New Limits
Bitcoin Depot said the breach was contained to its corporate environment and “did not affect the Company’s customer platforms, divisions, systems, data or environments.” It also said it brought in outside cybersecurity experts, though it still “continues to investigate the nature and scope of the incident.”
In March, Connecticut regulators suspended the company’s money transmission license as Bitcoin Depot charged some kiosk users fees above the state’s 15% cap and failed to give some fraud victims full refunds.
The company said in the latest regulatory filing it has insurance that may cover some of the loss, though “there can be no assurance that such coverage will be sufficient to recover any or all losses incurred as a result of this incident,” the filing reads.
