Bitcoin Depot has informed over 26,000 customers of a data breach that occurred in June 2024. The company only issued notifications in July 2025, over a year later. Sensitive data, including driver’s license numbers, was accessed by hackers. Federal authorities delayed public disclosure during their investigation.
The incident adds to the growing list of cyberattacks affecting the cryptocurrency industry. It also raises questions about the timing of breach notifications and how companies handle personal data.
Timeline and Impact of the Cyberattack
The breach was first detected on June 23, 2024, following suspicious system activity. Bitcoin Depot initiated a forensic review with outside cybersecurity experts. They confirmed that an unauthorized actor had accessed personal customer information.
Law enforcement instructed Bitcoin Depot to postpone informing customers until their investigation was complete. Clearance was finally granted on June 13, 2025. Affected users were notified starting July 8, 2025.
Exposed data included names, phone numbers, and driver’s license details. In some cases, addresses, birth dates, and emails were also compromised. This type of information is highly valuable for identity theft and fraud schemes.
Security Response and Industry Implications
Bitcoin Depot responded by enhancing its internal cybersecurity defenses. These include upgraded monitoring tools and mandatory training for staff. The company also urged customers to monitor financial activity, review credit reports, and consider fraud alerts or credit freezes.
This breach reflects a broader threat pattern in the cryptocurrency space. Fast growth, limited regulation, and varying security standards have made crypto platforms a key target. For companies like Bitcoin Depot, failure to protect user data can result in long-term reputational harm.
As cyber threats escalate, timely transparency and strong safeguards must become standard practice across the sector.
