Bitcoin Depot ATM stole lifesavings from a bunch of old people??

The Non-Financial Ledger

Karen Lacey was retired when this happened. She had earned it. She and her husband Robert had saved $76,000 — not a number on a spreadsheet, but the material result of a working life, set aside for a future they had a right to expect.

The scam did not begin with a gun or a break-in. It began with an email about a Norton subscription renewal. Karen did not click any suspicious links. She looked up the phone number herself, on Google, and called what she believed was a legitimate customer service line. That caution — that careful, reasonable instinct — was the first thing the scammers used against her. They answered the phone as Norton. They transferred her to a fraud department. They transferred her again to a man who said he was with the FBI.

He told Karen and Robert that their accounts had been hacked, that their identities had been used to purchase child pornography and facilitate illegal gambling, and that federal investigators were actively monitoring them. He directed them to a .gov website where official-looking government documents appeared to confirm everything he said. He told them they must not tell anyone — not their children, not their friends, no one — because the investigation would be abandoned and they would lose their case entirely.

Robert tried. Before a single dollar was deposited, he told Karen he was going to call the FBI himself to verify what they were being told. Before he could act, the voice on the phone told Karen to instruct her husband to get back in the car. The scammers already knew what he was about to do. They were watching. That moment — a stranger on the phone knowing exactly what her husband was doing in real time — did not register as a manipulation tactic. It registered as proof that every word they had been told was true. The last clear instinct toward caution was overwhelmed by fear.

Over five days, Karen and Robert returned to Bitcoin Depot ATMs as instructed. August 9: $25,000. August 11: $25,000. August 13: $13,000, then another $13,000. Wireless networks labeled “FBI” appeared among the available connections on their phones, visible confirmation that federal agents were watching their every move. Those networks stayed on their devices for months — disappearing on some weekends, reappearing again, as late as February 2026.

When it was over, Karen and Robert told no one for months. The silence was not indifference. It was shame. It was fear. It was the particular agony of knowing that you acted in good faith, did everything you thought was reasonable, and still lost everything. It was not until December 2025, when Karen visited her son, that she finally told him what had happened. Their retirement was gone. Karen was forced back to work. She now rotates day and night shifts at a hospital. The physical and emotional toll of that, at this stage in her life, is part of the cost that never appears in a settlement figure.

The complaint puts it plainly: “That silence, and the suffering behind it, is part of what Bitcoin Depot’s indifference cost them.”

Legal Receipts: What They Admitted in Writing

Bitcoin Depot’s own documents are its best prosecutors. Every quote below is verbatim from the source complaint, drawn from Bitcoin Depot’s SEC filings, published website content, and regulatory data cited in the litigation.

“Our products and services may be exploited to facilitate illegal activity such as fraud, money laundering, gambling, tax evasion, and scams.”
— Bitcoin Depot, Inc., Form 10-Q, SEC Filing, September 30, 2023, p. 67

• This is an admission, filed under penalty of securities law, that Bitcoin Depot knew its own infrastructure was being used for fraud. The company cannot claim ignorance in litigation while simultaneously filing this language with the SEC.
• The admission was made in September 2023 — nearly two years before the Laceys were victimized. The company had this knowledge and did not act on it in any meaningful way.

“Our risk management policies, procedures, techniques, and processes may not be sufficient to identify all risks to which we are exposed, to enable us to prevent or mitigate the risks we have identified, or to identify additional risks to which we may become subject in the future.”
— Bitcoin Depot, Inc., Form 10-Q, SEC Filing, September 30, 2023, pp. 63, 67

• While telling consumers their experience would be “safe and secure,” Bitcoin Depot was simultaneously telling investors the opposite: that it could not guarantee its own risk controls worked.
• This is the definitional gap between public marketing and internal reality. The same company issued both statements within the same operating period.

“fabricated sense of urgency, tricking you into making hasty decisions”
— Bitcoin Depot, Common Crypto Scams (March 10, 2025), bitcoindepot.com

• Bitcoin Depot’s own published educational content describes the exact psychological mechanism used against the Laceys — fabricated urgency — in precise terms. The company understood the tactic well enough to write a consumer guide about it.
• Understanding a harm and failing to engineer safeguards against it is a documented choice, not an oversight.

“play on your best and worst impulses”
— Bitcoin Depot, Common Crypto Scams (March 10, 2025), bitcoindepot.com

• This phrase, from Bitcoin Depot’s own website, demonstrates the company’s awareness that the psychological nature of these scams bypasses rational decision-making. Yet its sole countermeasure was an on-screen warning — precisely the tool that is useless when a victim cannot process rational information.

“By taking these measures, we are able to provide our customers with a safe and secure Bitcoin ATM experience.”
— Bitcoin Depot website, “Protecting Yourself from Bitcoin ATM Scams and Fraud”

“scammers pretend to be federal agencies, claiming that the victim has broken certain laws or regulations while using the Bitcoin ATM”
— Bitcoin Depot, “12 Days of Bitcoin #8 – Eight Bitcoin ATM Scams” (December 19, 2023), bitcoindepot.com

• Bitcoin Depot catalogued “Federal Agency Scams” — the exact category of scam used against the Laceys — on its own website in December 2023, eight months before the Laceys were victimized in August 2025. The company documented the threat and did not build meaningful defenses against it.
• The complaint notes this article was one of eight scam types Bitcoin Depot catalogued. The company possessed a detailed taxonomy of the fraud being committed through its machines and responded with stickers.

Public Deception: The Gap Between the Website and the SEC Filing

Bitcoin Depot maintained two simultaneous narratives about its own product: one for consumers who might use the machines, and one for investors who needed to know the real risks.

• Claimed to consumers: The company “employs various measures to protect customers from scams and fraud” and provides a “safe and secure Bitcoin ATM experience.” The company also represented that “customer support staff are readily available to address questions or concerns about potential transactions.” The documented reality: Bitcoin Depot’s primary anti-fraud measure was on-screen warnings and ATM stickers. No transaction monitoring for first-time users. No holding periods. No real-time intervention for obvious red flag patterns. No policies specifically designed to protect users over 60.
• Claimed “irreversibility” as a barrier to refunds: Bitcoin Depot told scam victims that Bitcoin transactions are “irreversible” as a basis for denying refunds. The documented reality: The cash fees Bitcoin Depot collects — documented in the complaint as typically 25-50% of each transaction — remain physically in Bitcoin Depot’s possession in the machine’s cash storage compartments, then transfer to Bitcoin Depot’s own bank accounts. Those fees are entirely reversible through standard refund procedures. The company’s claim of helplessness applies to the cryptocurrency transfer, not to its own retained cash.
• Disclosed to SEC investors: “Our products and services may be exploited to facilitate illegal activity such as fraud” and “our risk management policies may not be sufficient.” Disclosed to consumers simultaneously: “Safe and secure Bitcoin ATM experience” with “various measures to protect customers.”
• Claimed to serve the “unbanked”: Bitcoin Depot publicly markets its ATM network as serving the unbanked and facilitating international remittances. The documented reality: The complaint cites federal data establishing that elderly adults are the primary user demographic and primary fraud victims of Bitcoin ATMs, and that Bitcoin Depot was aware of this. The FTC found adults 60 and over are more than three times as likely as younger adults to report losses at Bitcoin ATMs and account for more than two-thirds of all dollars lost through these machines.

Profit-Maximization at All Costs

Bitcoin Depot’s fee structure and refund policy make one thing structurally clear: the company has no financial incentive to stop a fraudulent transaction, and a direct financial incentive to process it.

• Bitcoin Depot charged fees up to 50% of each transaction amount under its January 2025 terms of service. Its March 2026 revision replaced the explicit 50% cap with a $3.00 flat fee plus an open-ended markup the company itself warns customers “could be significantly greater” than competing services. The upper bound is now undefined.
• The complaint is explicit: “Because Bitcoin Depot collects its fees the moment a transaction is completed, the legitimacy of that transaction is, financially speaking, irrelevant to the company. A scam victim feeding cash into a Bitcoin Depot kiosk generates the same revenue as any other customer.”
• When California capped daily Bitcoin ATM transactions in January 2024, Bitcoin Depot’s full-year revenue fell roughly 17% — from $689 million in 2023 to $573.7 million in 2024. The company’s earnings report cited that California law directly as a primary driver of the decline.
• When a new wave of state transaction caps took effect in late 2025, quarterly revenue fell another 15% — from $136.8 million in Q4 2024 to $116 million in Q4 2025. Bitcoin Depot’s CEO again pointed to regulation as the main cause.
• Bitcoin Depot has warned investors to expect its core business revenue to fall an additional 30% to 40% in 2026 as regulatory pressure continues. Every time transaction volume is restricted by law, revenue falls in lockstep. The revenue line is a fraud-volume tracker.
• If a refund is granted at all, Bitcoin Depot’s refund policy reserves the right to charge the victim an additional fee of up to 10% of the transaction amount and to keep any market gains on the refunded funds. The company profits from its own refund process.
• The complaint states that Bitcoin Depot’s “refusal to implement adequate safeguards is driven by economic considerations. The company understands that effective protective measures would reduce transaction volume and the substantial fees it derives from each completed transaction, regardless of legitimacy.”

Regulatory Gray Zones: Speed by Design

Bitcoin Depot’s ATM model was deliberately structured to exploit features that traditional financial regulators had not yet addressed, creating a friction-free corridor for fraudulent cash transfers that wire transfer systems and money order services had already closed off.

• Bitcoin Depot operates “non-custodial” wallets — anonymous wallets brought by users or generated by the ATM — which means the company maintains no control over or knowledge of who accesses the wallet’s private keys. Traditional cryptocurrency exchanges that comply with anti-money laundering regulations require identity verification and maintain custodial control. Bitcoin Depot’s non-custodial model places it outside that compliance architecture by design.
• Unlike traditional wire transfer services and money order systems that have implemented fraud safeguards specifically because they were previously abused by scammers, Bitcoin ATMs occupied a newer regulatory space. The complaint notes that “traditional wire transfer services and money order systems have implemented safeguards that make Bitcoin ATMs more attractive for fraudulent schemes” — meaning that increased regulatory scrutiny on older transfer methods pushed fraud directly into Bitcoin Depot’s lane.
• California’s transaction cap, which caused Bitcoin Depot’s revenue to fall 17% in one year, was a state-level patch on a gap in federal oversight. Bitcoin Depot’s own investor warnings acknowledge a growing wave of state-level regulations, demonstrating that the regulatory framework for Bitcoin ATMs was built reactively, after harm was established, rather than proactively. The company operated profitably inside those gaps for years.
• Bitcoin Depot’s terms of service grant it sole discretion to deny any refund request for any reason, and allow it to charge a penalty fee of up to 10% of the transaction amount even when it does grant a refund. No equivalent protection exists for consumers in a regulatory framework that would require standardized refund procedures for fraud-affected transactions.

Societal Impact Mapping

Public Health and Psychological Harm

The documented harms in this case extend well beyond financial loss into long-term psychological injury for a class of victims already identified by federal data as disproportionately targeted.

• Karen Lacey was retired when the fraud occurred. The $76,000 loss represented her and Robert’s entire savings. She was forced back into the workforce and now works rotating day and night hospital shifts, a physically and emotionally demanding schedule that the complaint describes as taking “a physical and emotional toll on her at this stage in her life.”
• The Laceys lived with the trauma in silence for approximately four months before Karen disclosed what had happened to her son in December 2025. The complaint identifies shame and fear as the operative barriers: “They had felt too ashamed, and honestly still too frightened, to do anything about it.” This psychological harm is not peripheral to the case; it is a documented consequence of a scam model designed to maximize victim isolation.
• The FTC found that adults 60 and over were more than three times as likely as younger adults to report losses at Bitcoin ATMs and accounted for more than two-thirds of all dollars lost through these machines. The median reported loss was $10,000 per victim, compared to $447 in general fraud cases — 22 times higher. Elderly adults on fixed incomes have no mechanism to absorb losses at that scale.
• The scam model itself — impersonating law enforcement, fabricating criminal allegations including child pornography, and threatening victims with legal jeopardy if they speak to anyone — is designed to weaponize shame and fear as containment tools. The Laceys’ months of silence are not an anomaly; they are the intended outcome of the psychological architecture of the fraud.
• The complaint notes that many class members “may be unaware of their legal rights or too ashamed and frightened to pursue individual legal action” — a direct acknowledgment that the psychological damage of these scams suppresses accountability as a secondary effect.

Economic Inequality

Bitcoin Depot’s ATM network is concentrated in the infrastructure of economic precarity: convenience stores, liquor stores, gas stations, and grocery stores — the places that cash-dependent, unbanked, or low-income consumers are most likely to frequent.

• Bitcoin Depot operates approximately 60 locations in Idaho alone, “embedded in Idaho communities” according to the complaint, with each machine placed through partnership contracts designed to maximize access to cash-carrying consumers in high-traffic retail environments.
• The median loss of $10,000 per Bitcoin ATM fraud victim is catastrophic at the income levels typical of the demographics these machines serve. A $10,000 loss represents months of income for many elderly adults on Social Security or fixed pensions. For the Laceys, the $76,000 loss was their entire retirement savings.
• The complaint documents that Bitcoin Depot charges fees up to 50% of each transaction — fees substantially higher than those of online cryptocurrency exchanges. This premium falls hardest on consumers who do not have access to, or familiarity with, digital financial services: exactly the population Bitcoin Depot markets to as the “unbanked.”
• The FTC documented that fraud losses at Bitcoin ATMs increased nearly tenfold from $12 million in 2020 to $114 million in 2023, and that 2024 was on pace to exceed $130 million. These losses are not distributed evenly across income levels: they concentrate in the elderly, the less digitally literate, and those in financial distress — the populations least equipped to absorb them.

Who Pays? Following the Cost

When a Bitcoin Depot transaction completes, the cash flows in three directions simultaneously: a portion to Bitcoin Depot as fees, a portion converted to cryptocurrency and transferred to the scammer’s wallet, and the entire loss absorbed by the victim. After the fact, the cost is redistributed further.

• The Laceys deposited $76,000 in cash into Bitcoin Depot ATMs. Bitcoin Depot retained a documented portion of that as fees and markups — amounts the complaint describes as ascertainable from Bitcoin Depot’s own transaction records. Of that amount, Bitcoin Depot returned $2,000 via two $1,000 checks after an attorney intervened, a report was filed with the FBI, and an IC3 complaint was submitted. The remaining fees were retained.
• Karen Lacey absorbed the cost directly: the loss of her retirement, the end of her retirement status, and the physical and emotional cost of returning to rotating hospital shifts. No government program, no insurer, and no social safety net is structured to replace savings stolen through a cryptocurrency ATM. The cost transfers entirely to the victim’s body, labor, and remaining years.
• The FTC documented more than $65 million in Bitcoin ATM fraud losses in the first half of 2024 alone. Those losses, distributed across thousands of victims — disproportionately elderly, disproportionately on fixed incomes — represent a transfer of wealth from some of the most economically vulnerable Americans into the accounts of both scammers and the ATM operators collecting fees on every transaction.
• The complaint argues that Bitcoin Depot’s inadequate response creates social costs: “increased victimization of consumers who may be more susceptible to high-pressure tactics,” and “systematic financial abuse targeting vulnerable populations.” Law enforcement resources — the FBI, IC3 complaint systems, and local police — absorb the cost of responding to fraud cases that effective operator safeguards would have prevented.

Why a Token Refund Isn’t Justice

Bitcoin Depot’s response to the Laceys after they reported the fraud, retained an attorney, and filed a federal crime complaint was to mail two checks totaling $2,000 against $76,000 in documented losses.

• The two checks, each for $1,000, were characterized as “Customer Refunds.” The complaint is specific: the combined total “did not even cover the fees Bitcoin Depot had collected from Plaintiffs’ transactions.” Bitcoin Depot returned less than the fee it charged to process a fraud.
• The refund was issued only after the Laceys’ son retained an attorney, notified Bitcoin Depot of the fraud, and filed an IC3 complaint with the FBI. Without legal intervention, the company’s standard response was no refund at all. Consumer complaints documented in the litigation show Bitcoin Depot telling other victims “there is nothing they can do” and denying refunds on the grounds that transactions are “irreversible.”
• Bitcoin Depot’s refund policy, as documented in the complaint, allows the company to deny any refund request “for any reason, at its sole discretion.” If a refund is granted, the company may charge the victim an additional fee of up to 10% of the transaction amount and may keep any market gains on the refunded funds. Victims are financially penalized for requesting the return of money stolen through fraud.
• The complaint cites a specific BBB complaint from April 2025 in which a victim deposited $9,900 into a Bitcoin Depot ATM after being scammed. Bitcoin Depot refused a refund and stated “it was a legit deposit.” This is Bitcoin Depot’s documented institutional posture toward fraud victims in the absence of legal pressure: denial.
• The structural deterrence problem is direct: Bitcoin Depot collects its fees before any fraud report is filed and retains those fees unless legally compelled to return them. The cost of non-compliance is lower than the cost of building real safeguards, so long as most victims do not sue.

“Of the $76,000 Plaintiffs lost, Bitcoin Depot’s response was to return $2,000.”
— Lacey et al. v. Bitcoin Depot, Inc., Complaint ¶78

How Delay Worked as a Corporate Weapon

Bitcoin Depot’s documented posture toward known fraud victims — denial of refunds, assertion of irreversibility, absence of proactive outreach — functioned as a delay strategy that reduced the proportion of losses ever recovered or litigated.

• The Laceys did not report the fraud for approximately four months after the final transaction in August 2025, disclosing to their son in December 2025. The complaint explicitly identifies shame and fear as the mechanisms that produced this delay. A business model that exploits those emotions benefits directly from the silence they generate: fewer reports, fewer complaints, fewer lawsuits.
• The complaint notes that many class members “may be unaware of their legal rights or too ashamed and frightened to pursue individual legal action.” Elderly victims on fixed incomes are also least likely to have retained legal counsel or to understand that a civil claim is available to them. Bitcoin Depot’s token refund of $2,000 — extended only after legal pressure — functions as a deterrence-minimizing gesture: sufficient to discourage individual litigation, insufficient to constitute accountability.
• The BBB complaint record cited in the lawsuit documents a pattern of Bitcoin Depot telling victims “there is nothing they can do.” That response, repeated across multiple documented complaints, is a documented institutional delay tactic: it creates a false endpoint in the victim’s recovery process, at the moment most likely to prevent escalation to legal action.
• Bitcoin Depot’s terms of service preserve the company’s right to deny any refund for any reason at its sole discretion. This structural discretion means the company can extend the period between fraud occurrence and any form of accountability indefinitely, on a case-by-case basis, without any external trigger requiring action.