Bitcoin Depot Waited a Year to Spill the Beans on a 27K Customer Data Leak đź‘€

by

So, imagine you’re just minding your own business, awkwardly trying to buy Bitcoin from a chunky yellow ATM that looks like it’s plotting something, and—surprise!—almost a year ago, your personal info was slipping out the back door like it was late for a hot date. 🍸

Apparently, Bitcoin Depot has *finally* sent out its breakup letter (sorry, “data breach notification”) about an “oopsie” from the summer of 2024, letting nearly 27,000 customers know they were unwitting extras in a hacker’s heist movie.

But wait, there’s a twist. According to a spokesperson (who I’m picturing wearing sunglasses indoors with a dramatic latte), federal law enforcement told them, “Shhh, darling, hold the panic tweets—we’re still investigating.” Because nothing says “confidence” like asking your customers to kindly stay blissfully ignorant until the government’s had a look around. 🕵️‍♂️

Then, just in time for a sweaty June, law enforcement sent their “you may now notify the peasants” blessing, so Bitcoin Depot got to drafting those fun emails we all dread.

If you’re keeping track: hackers this year alone have cracked open more accounts than a toddler with an Easter egg, with billions of credentials floating around and even the mighty Coinbase coughing up user data in May. Can’t wait for the spin-off podcast.

Names, addresses… The hacker’s bingo card is filling up

According to the official nervously-worded notice, the bad guys grabbed a goodie bag of user details—names, phone numbers, driver’s license numbers. Oh, and potentially addresses, birthdays, and emails. All the ingredients for identity theft, but don’t worry—Bitcoin Depot swears there’s “no evidence” anyone’s actually used the data yet. (Like getting your diary stolen but the thief is being super respectful… for now. Right.)

Helpful tip time: secure your credit, freeze everything but your cold brew, and watch your credit report like your ex stalking your new Insta. Definitely sounds like a relaxing post-crisis protocol.

The hacker, the cybersecurity firm, and a bunch of dramatic pauses

The story gets juicier: after “detecting unusual activity” (read: someone finally noticed things weren’t supposed to be on fire), Bitcoin Depot summoned a “leading cybersecurity firm”—which may or may not have arrived with capes. By July 18th, the experts confirmed someone had tiptoed through the customer files like Goldilocks, except with less porridge and more password dumps.

Since, the company’s gone full fortress-mode—supposedly tightening security, watching for bogeymen, and, presumably, offering a seminar on turning things off and on again.

Everyone’s doing the data breach cha-cha

If you thought Bitcoin Depot was special—bless you. A few months back, Byte Federal admitted they’d lost track of *58,000* customer records thanks to software with more holes than a student’s alibi. They immediately “shut everything down” and assured us that no funds were lost—just another Tuesday!

And our old friend Coinbase? In May, insiders were bribed for juicy customer data, hackers swung by with a $20 million ransom note, and Coinbase noped out faster than you do when you see your ex at Tesco. User data leaked, frustrations leaked, the only thing not leaking was actual cash. For now. (Cue dramatic soap opera zoom-in.)

Read More

2025-07-10 09:37