On April 6, 2026 BitcoinDepot (BTM) disclosed in an SEC 8K filing it uncovered an incident on March 23, 2026 which resulted in 50.9 BTC ($3.6M) stolen.

However the report did not include theft addresses so I manually traced out the incident onchain and found 19 high confidence theft addresses from March 20.

This means it took three days for BitcoinDepot to notice the funds were missing from its business.

A delta of 3.55 BTC (54.45 BTC total) vs 50.9 BTC reported was found indicating other employee personal accounts may have also been impacted.

54 BTC ($3.7M) flowed to KuCoin, a crypto exchange increasingly used by illicit actors. 

At the time of my post the theft addresses still have not been reported in any compliance tools I use.

Suspected theft addresses:
bc1qqt65qe94rm5kh7srhpp2u5cd5gtcc3peyesfmz
bc1q9mppvhrrmdw9d05tvtvacgk87muvwstpxt59ce
bc1qg4evf89vlnd5escw5lf3pksftljkj8hczwed3k
bc1qzjt0l0tutwrqgq7ftv9l405qqu5gvsh0j8en0z
bc1qmx2sunxc76kdpsdhtnt7gdwcdhz6zptypy60tj
bc1qqnnh38wu4clderxu6x8fanqtekjehhvd9n0m4d
bc1qegrffryc6s80u7jcehyqzw2c30rzwhweq8x33k
bc1qt6cc729nz2pu5mjlmj36ajxn9put8372s3dshk
bc1qyym7sqe95h4003c6fk0p8r2q4vdzm2hx64hazz
bc1q4ut9geva75wyeh78vx7tm4lehlkl77z6w5vksp
bc1q4vjezx6rf9xkpcassmmlpd3678593q5lk3lg7p
bc1qp989gkepg255ngkntd4sppnzzg6fcx997tjz79
bc1qyzqsnn4msw4a2ar0397da7xe4f2r8wt4fn2l9c
bc1qaqkk0sdp7mmjpr5ax7dphuxt7wv8qtkgu6pevd
bc1qfhafkxq388k3adlvn8qaqf7y486u3rauaqg75y
bc1qq6cy97pyhmnw52p6906uupyca02uq563ndy9r6
bc1qsrxf2cmmausfdkyq34mcluluvmlr0e5s7c8n7s
bc1qc3py8la4y4864wkvjpjwvq6690u7uxse0lgrzs
bc1q5aes997chagmc6h8z4nlq0nk2waj8ff370hnlu