Bitcoin ATMs: $389M Lost to Scams in 2025, and Bitcoin Depot Went Bust

On 9 February 2024, Carrie Carlson withdrew $14,100 from her bank accounts and fed it, in $100 bills, into a machine inside an Amoco petrol station in Cedar Rapids, Iowa. The day before, she later told the Linn County Sheriff's Office, a caller claiming to be from the Geek Squad, the computer repair service of the retailer Best Buy, had said her accounts were compromised. To keep her money safe, she was to buy bitcoin and send it to a wallet he named. The machine did what it was built to do. It took the cash and sent 0.2296 bitcoin to the address she gave it.

Three days later deputies searched the machine with a warrant. It had not been emptied, and her banknotes were still inside. It made no difference. In May 2025 the Iowa Supreme Court ruled unanimously that the cash belonged to the machine's owner, Bitcoin Depot, because Carlson had confirmed on screen that the wallet was her own.

Crypto ATMs, kiosks in petrol stations, corner shops and supermarkets that turn banknotes into bitcoin, have become the telephone fraudster's favourite till. In 2025 the FBI's Internet Crime Complaint Center (IC3) received 13,460 complaints involving the machines, with $389 million lost: 58% more than in 2024 and about double 2023. People aged 60 and over filed 6,188 of those complaints and lost $257 million, about two dollars in every three. Then, in 2026, the machines began to disappear. Bitcoin Depot, once North America's largest operator with more than 9,000 kiosks, filed for bankruptcy on 18 May and switched its whole network off, and states and towns from Indiana to Hawaii to Jackson, Michigan, banned them.

©CMZ chart. Data: FBI IC3

How the scam works

Bitcoin is a digital currency that no bank runs. Coins sit in "wallets", which work like bank accounts identified by a long string of letters and numbers, and payments between them are final. There is no fraud department and no chargeback, much like handing over cash. A crypto ATM is the cash counter for that system: feed it notes, show it where to send the coins, and they arrive within minutes, anywhere in the world.

The FBI, the Federal Trade Commission (FTC) and the lawsuits describe the same script.

First, the approach. A pop-up on a laptop says the computer is infected and gives a number to call, or a caller claims to be from the victim's bank, a government agency, the police or a big tech company. The FTC found that government impersonation, business impersonation and tech support scams made up about 86% of reported bitcoin ATM losses in the first half of 2024.

Second, the fright. The victim hears that the bank account has been hacked or used for crime, and that the savings must be moved at once to stay safe. Secrecy is part of it.

Third, the cash. The victim withdraws a large sum, often in $100 bills. The FBI now lists first-time large cash withdrawals, and customers on the phone looking confused at the bank counter, among its warning signs.

Fourth, the machine. The caller names a nearby kiosk and stays on the line. He texts a QR code, the square barcode a phone camera reads, which holds the scammer's wallet address. The victim holds it up to the kiosk's camera, feeds in the notes and, when the screen asks whether the wallet is theirs, taps yes, because the caller says to.

Fifth, the repeat. Once one payment goes through, there is a reason for another. In the first half of 2024, the FTC found, the median reported loss at a bitcoin ATM was $10,000.

©CMZ chart. Data: FBI IC3 2025 report

The operator takes its cut on the way through. Iowa's attorney general, Brenna Bird, said in February 2025 that Bitcoin Depot kept 23% of the money Iowans sent through its machines and its rival CoinFlip 21%, far more than any stockbroker charges to buy a share.

Two victims, one answer

Steve Beckett, a retiree in his sixties who had worked in casino management and securities sales, saw a pop-up on his laptop in December 2024 warning that it had been hacked. The number connected him to a man calling himself Josh, supposedly from Microsoft support, who said hackers had used his details to buy child sexual abuse material. Then came callers posing as his bank and the Federal Reserve, the US central bank, who said he faced prison unless he protected his savings by turning them into bitcoin. Over two days he withdrew $7,000 and fed it into a Bitcoin Depot machine at a Circle K in Lawrenceburg, Indiana. The familiar shop reassured him. "You think everything in a convenience store is for your convenience," he told CNN.

In July 2025 Beckett sued Bitcoin Depot in federal court in Indianapolis, accusing it of "systemically facilitating" scams and seeking to represent other victims in a class action. On 26 February 2026 the judge sent his claim to private arbitration instead, finding that he had accepted the kiosk's on-screen terms in each of his three transactions, despite red warning text that a QR code supplied by someone else "is most likely a scam."

Carlson's case in Iowa went the same way. The Linn County district court gave her the $14,100 back, likening it to recovering stolen goods from a pawnbroker. The Iowa Supreme Court reversed that on 16 May 2025. Justice Dana Oxley wrote that warning customers, even "to the point of barring a transaction unless the user certifies that the wallet is their own", did not make Bitcoin Depot "liable for every improper transaction." A warning label, the court reasoned, protects the manufacturer. A second victim, Shelby Cason, lost the same argument in a companion appeal.

Bitcoin Depot's collapse

Bitcoin Depot, based in Atlanta and listed on the Nasdaq under the ticker BTM, began putting machines into Circle K convenience stores under a partnership announced in 2021, and by late 2025 had them in about 750 Circle K stores in the US and Canada. The International Consortium of Investigative Journalists (ICIJ) and CNN counted more than 150 alleged victims reporting scams at Bitcoin Depot machines in Circle K and Holiday stores since January 2024, with at least $1.5 million lost. Circle K said the machines belong to third parties; Bitcoin Depot said it could not be liable for scammers' crimes.

The pressure came from the states. Iowa sued Bitcoin Depot and CoinFlip in February 2025. Massachusetts attorney general Andrea Joy Campbell sued Bitcoin Depot on 3 February 2026, alleging it knowingly facilitated scams that cost Massachusetts consumers more than $10 million and refused refunds. The company, which denied facilitating scams, began requiring identity checks on every transaction. Connecticut suspended its money transmission licence, and Alex Holmes took over as chief executive in March.

In the first quarter of 2026 revenue fell 49% from a year earlier, and a $12.2 million profit became a $9.5 million loss, CoinDesk reported. On 18 May 2026 Bitcoin Depot filed for Chapter 11 bankruptcy in the US Bankruptcy Court for the Southern District of Texas to wind itself down and sell its assets. Every machine went offline. Holmes blamed stringent compliance rules, transaction limits and outright bans, and concluded that "the Company's current business model is unsustainable."

The machines did not all vanish. Bitcoin Bancorp, a Las Vegas company whose shares trade for about four cents, won about 2,500 of them for $620,750, CoinDesk reported, plus $110,500 for the brand, patents and the BitcoinDepot.com domain. On 9 September it announced court approval and plans to expand.

The bans

Indiana became the first state to ban the kiosks outright in March 2026, when Governor Mike Braun signed the law. Tennessee's, signed by Governor Bill Lee, took effect on 1 July. Minnesota has ordered its machines gone by the end of 2026, and Hawaii bans kiosks that take cash from 1 October.

Towns are not waiting. On 22 September 2026 the city council in Jackson, Michigan, voted unanimously to ban kiosks, and even crypto purchases rung up by a shop cashier. The ordinance takes effect on 22 October, operators then have 90 days to remove their machines, and each day a kiosk stays after notice counts as a separate $500 violation. Michigan residents filed 368 kiosk complaints to the IC3 in 2025 and lost $11.9 million. Texas topped the country with $56.8 million lost.