The Bitcoin ATM Industry Finally Cashed Out 

• Bitcoin Depot, the largest US operator, filed Chapter 11 on May 18, 2026 and took all 9,000-plus machines offline the same day, blaming regulation while its Q1 2026 revenue had already fallen 49%.
• The margin and the fraud were the same transactions. Operators took roughly 20–23% per transaction, and Iowa’s investigation found 98% of the money sent through Bitcoin Depot in-state was scam-driven.
• Caps and refunds broke the economics precisely because the margin lived in the coerced five-figure deposits the rules were written to stop.
• Regulation escalated in two years from federal AML, to consumer caps (California’s $1,000/day limit and 15% fee ceiling), to outright bans in Indiana, Tennessee, and Minnesota, with Delaware and New Jersey next.
• Every major market converged on the same answer. AUSTRAC’s A$5,000 cap, the UK’s de facto closure, and the consistent finding across jurisdictions that older adults are the dominant victims.

When Bitcoin Depot filed for Chapter 11 in the Southern District of Texas on May 18, 2026, it did not quietly restructure. It pulled all 9,000-plus of its machines offline the same day and announced an orderly wind-down and asset sale, which for North America’s largest Bitcoin ATM operator is a polite way of saying the business is over. CEO Alex Holmes blamed the regulators, telling the market the compliance environment had shifted so far that the model was “unsustainable”. The convenient part of that story is that it is half true, and the other half is sitting in the Iowa Attorney General’s case file, where it explains why the regulation bit so hard in the first place.

Bitcoin Depot’s own numbers had cracked well before the filing. First-quarter 2026 revenue fell 49.2% year over year, the company swung to a roughly $9.5 million net loss against $12 million of net income a year earlier, the stock had shed most of its value, Connecticut had suspended its money-transmission license, and somewhere in April hackers walked off with $3.7 million from its hot wallets. A going-concern warning landed on May 12, six days before the petition. This was a company that had gone public on a SPAC valuing it near $885 million in 2023, and it reached the courthouse listing about $11 million of assets against $27 million of liabilities. No single rule killed the kiosk business. It got repriced, and the price it had been quietly running on turned out to be fraud.

The margin and the fraud were the same transactions

Start with how a kiosk made money, because the economics and the harm are the same transaction seen from two angles. The customer feeds in cash, the operator quotes a price built from a flat service fee plus a markup against whatever exchange rate the operator selects (often at its own discretion, against a benchmark it picks), and the crypto goes to whatever wallet the customer scanned. The all-in take ran high. Iowa’s investigators put Bitcoin Depot’s cut at about 23% and CoinFlip’s at 21% of the money fed through their machines, an order of magnitude above what the same customer would pay buying spot on a regulated exchange. The industry has always defended that spread as the cost of instant cash conversion, and there is a genuine cost in armored cash logistics, insurance, and compliance staffing buried in it. The trouble is what the spread was being charged on.

The future of finance is here. Trade crypto and more

When Iowa Attorney General Brenna Bird subpoenaed fourteen operators and traced where the cash went, the picture had almost nothing to do with unbanked users buying a little Bitcoin. Fully 98.16% of the money sent through Bitcoin Depot, and 94.92% through CoinFlip, was tied to scams since October 2023. Read that next to the fee structure and the model becomes legible. The machine took roughly a fifth of every transaction, and the overwhelming majority of those transactions were victims being talked through the screen by someone on the phone. The fee rode on the fraud. It was the revenue, and the fraud supplied the volume.

That is also why caps and refunds hit the business so much harder than the operators admitted in public. A 15% fee ceiling and a $1,000 daily limit do not merely trim a margin, they remove the high-value coerced deposits that produced the margin, because the scam scripts depend on moving five figures fast. The clearest illustration came out of the same Iowa litigation, where a lower court ordered $28,000 in seized funds returned to the victims and the Iowa Supreme Court reversed, letting the operator keep the money on the strength of the kiosk’s own contract terms. When the courts have to decide whether stolen funds belong to the victim or to the machine, the business has stopped resembling ordinary payments infrastructure.

Who fed the machines

The demographics settle most of the argument. The FBI’s Internet Crime Complaint Center counted more than 13,400 kiosk-related complaints and over $388 million in reported losses for 2025, a 23% jump in complaints and a 58% jump in losses over 2024. People over 50 filed more than half the complaints and accounted for over $302 million of the loss, roughly four dollars in five. The comparable 2024 tally that FinCEN had cited ran near $247 million across roughly 11,000 complaints, so a single year added well over a hundred million dollars to the reported toll. The FBI also notes that most kiosk fraud never gets reported, so the real figure sits above the one everyone quotes, and the trajectory is not new. The FTC had already flagged a near-tenfold rise in reported kiosk-fraud losses between 2020 and 2023, with older adults reporting losses at several times the rate of younger ones, so the curve was visible for years before the bans arrived.

The pattern underneath the numbers is monotonous, which is the tell, because monotony is what an industrialized fraud channel looks like. A caller manufactures urgency, often posing as a government agent, a bank’s fraud desk, or tech support, instructs the target to pull cash from the bank, sends them to a specific kiosk, and walks them through scanning a QR code that routes the coins to the fraudster. Settlement is final, recovery is rare, and the operator collects either way. Maine’s regulator saw the shape clearly enough that it denied Bitcoin Depot a license on the finding that elderly residents accounted for more than 70% of the money moving through its machines in the state.

None of this is a peculiarly American lapse in supervision, which is the detail that sinks any attempt to read it as one. Australia’s financial intelligence agency obtained data from nine kiosk operators and found that users over 50 drove almost 72% of transaction value, with the 60-to-70 bracket alone accounting for 29%. That profile, weighted toward the people with the most retirement savings to lose, describes a victim base rather than the customers an inclusion product would attract.

The retail hosts saw it before the regulators did

The merchants hosting these machines often reached the conclusion ahead of any agency. In April 2024 the grocery chain Fareway signed a deal to put 66 Bitcoin Depot machines in its stores, and by the following February it had unplugged every one of them, calling them “instrumentalities of massive fraud” as customers were being defrauded almost weekly. Bitcoin Depot’s response was to sue Fareway for breach of contract, demanding the chain switch the machines back on and pay damages for lost business. A host that watched its own customers get robbed in its aisles wanted out, and the operator went to court to keep the kiosks live, which is about as clean a statement of incentives as the sector has produced.

That fight only makes sense given how concentrated the market is. Bitcoin Depot, CoinFlip, and Athena Bitcoin together ran more than 16,000 of the United States’ machines, over half the national footprint, according to Coin ATM Radar’s tracking. Prosecutors in Washington, D.C. reached findings about Athena’s machines that echoed Iowa’s about the other two, so the scam concentration was not one bad operator but the shape of the leading networks. Much of that scale was built through affiliate and turnkey arrangements, where a platform supplies software, compliance tooling, cash handling, and branding to nominally independent local operators, which spreads the footprint quickly and smears accountability across the owner, the software vendor, and the host retailer until it is genuinely unclear who is supposed to screen the destination wallet.

From AML to caps to outright bans

For most of the kiosk era the only binding rule was federal anti-money-laundering law, where FinCEN has long treated anyone exchanging and transmitting convertible virtual currency as a money transmitter, with the registration, monitoring, and suspicious-activity reporting that implies. That regime polices laundering and not the fee charged to a 70-year-old, so it left the consumer side almost entirely to the states, which then moved through three escalating postures in about two years. The speed of that escalation is the real story.

California wrote the template the consumer-protection wave copied. Its Digital Financial Assets Law capped kiosk transactions at $1,000 per customer per day, limited fees to the greater of $5 or 15%, and forced operators to hand over a receipt disclosing the spread against the licensed exchange price they used, with full DFAL licensing due by July 1, 2026. A court upheld the daily limit against an industry challenge that called it arbitrary, and the state regulator started fining operators well before the licensing gate, including a $675,000 penalty against Coinhub for breaching both the daily limit and the fee cap, some of it on transactions above $10,000 involving older customers. Nebraska and Arizona followed, with Arizona requiring licensing, five-year encrypted record retention, a designated compliance officer, and lower daily limits for new users than for established ones, and Nebraska pairing its fraud-prevention regime with explicit refund obligations.

In crypto, one bad click is final. Learn to verify before you lose.

Disclosure was the first instinct and the weakest lever, because the consumer the rules meant to protect was the one least able to use the information. A receipt itemizing the spread against a licensed exchange does real work for a price-conscious buyer comparing options, and none at all for a 73-year-old on the phone with a man claiming to be from the IRS who has told her not to hang up. Transparency assumes a shopper, and the kiosk’s defining customer, on the regulators’ own data, was a person acting under instruction, which is why states that began with receipts and warnings kept sliding toward caps and then toward pulling the machines.

Then the posture flipped from regulation to prohibition. Indiana became the first state to ban the machines outright in March 2026, with AARP pushing the bill through a unanimous Senate and the governor signing it on March 9. Tennessee criminalized kiosk operation as a misdemeanor in April, and Minnesota’s governor signed a ban in May that orders operators dark by August. As of this week, Delaware and New Jersey have both moved ban bills out of committee, each carrying penalties up to $10,000 a violation. AARP’s count has 30 states introducing kiosk legislation in 2026, and the politics are hard to fight when a state representative can stand at the lectern and cite an investigation finding that almost all of one operator’s volume was fraud.

Everyone else arrived at the same place

The international regulators converged on the same answer from different starting points, which removes the “America overreacted” defense. Australia took the conditions route hardest. After a taskforce flagged the age-skewed usage data, AUSTRAC imposed a A$5,000 cap on cash deposits and withdrawals, mandatory on-screen scam warnings, enhanced due diligence, and tighter monitoring, framing the conditions as a way to deter criminals from steering victims to a machine at all. It also stopped treating registration as a formality, refusing to renew the registration of one operator whose machines it judged too exposed to misuse to keep running.

Australia’s concern was never only the victims. Its review of high-volume users turned up money mules and suspected offenders sitting alongside the scam targets, and the home affairs minister has said most top kiosk users are tied to illicit operations, linking the machines to laundering and the drug trade as the government drafts powers to treat them as high-risk products. FinCEN’s own Bank Secrecy Act analysis has flagged kiosks used to launder suspected drug proceeds, so the channel carried value in both directions, victims feeding it on one side and criminals cycling proceeds through it on the other. Australia ran 23 of these machines in 2019 and more than 1,800 by the time AUSTRAC moved, which is the adoption curve the supervision was chasing.

Britain skipped the gradient and reached a closed market in practice. The FCA’s position is that offering crypto ATM services requires registration under the money-laundering rules, that no firm has been approved to do it, and that any machine operating in the country is therefore illegal, a stance it has backed by bringing criminal charges against an operator. Germany’s regulator has treated installing and running kiosks as licensable activity and seized unlicensed machines, though I have not independently confirmed the specific 2024 seizure counts that circulate in industry write-ups. Canada folds virtual-currency ATM operators into its FINTRAC money-services regime with identity, recordkeeping, and large-transaction reporting duties, and the EU’s MiCA framework pulls most kiosk activity into the crypto-asset service provider perimeter with authorization and travel-rule obligations attached. The tools differ but the destination is the same, with the friction-light cash-to-crypto kiosk either heavily constrained or quietly zoned out of existence across every major market.

The inclusion story the data never backed up

The industry’s defense has always rested on financial inclusion, and it deserves a fair hearing because the core claim is not absurd. Kiosks are the only way to turn physical cash into crypto without a bank account or an exchange login, and for someone unbanked or simply unwilling to trust an app with their money, a machine in a gas station lowers a real barrier. CoinFlip has argued exactly this in public, with its general counsel telling Minnesota legislators that scammers abuse every payment channel and nobody proposes banning gift cards or wire transfers over it, so the answer should be tighter rules rather than prohibition. When California’s bill was moving, the kiosk industry warned that the fee cap and transaction limit would simply drive the machines “out of our communities” while doing nothing about fraud.

The first half of that prediction came true and the second half undercuts the whole defense. The machines are leaving, and Bitcoin Depot’s bankruptcy is the proof. But the claim that consumer rules do nothing about fraud only holds if the legitimate-use base is large, and every official dataset that has traced the money keeps saying it is not. Iowa, Maine, and Australia all find the same skew toward elderly victims moving large coerced sums, and none of them surface the thriving population of contented unbanked cash users the inclusion argument requires. That population may exist somewhere below the reporting threshold. It has never appeared in the numbers at anything close to the scale needed to justify the channel’s harm, and after a decade of operation the absence of that evidence is itself a finding.

There is a fair point buried in the operators’ grievance. A scammer who loses the kiosk does not retire but moves the victim to a gift card, a wire, or a peer-to-peer transfer, and several of those rails are harder to trace than a public blockchain. Killing kiosks relocates the scam rather than ending it, and that argument has real force on fraud displacement. It loses on consumer protection, because the kiosk combined irreversibility, a 20%-plus take, and a screen that guided a panicked person through each step, which made it the most efficient single rail for turning an elderly victim’s savings into unrecoverable crypto. Closing the most efficient channel still helps even where it does not solve the underlying crime.

What survives, and who the bankruptcy protects

The live question now is not whether the legacy model returns, because it does not, but what a defensible version would look like and whether anyone can run it at a profit. Strip the kiosk down to what regulators will tolerate and you get hard per-customer caps that kill the five-figure deposit, all-in pricing shown on screen before cash goes in, real refund windows when fraud is reported quickly, destination-wallet screening against known fraud addresses, and trained staff who can halt a transaction when an older customer is on the phone repeating a stranger’s instructions. Each of those measures targets the scam script directly, and each strips out revenue, while the underlying cost base of armored carriers, surveillance, insurance, blockchain access, and AML staffing stays fixed. That is the squeeze that took Bitcoin Depot down, and it does not relent for whoever inherits the machines.

Buy bitcoin and stocks. Signup to Coinbase today

The bankruptcy itself shows who the current structure protects. A week before the filing, a couple sued Bitcoin Depot after one of them was talked through a textbook impersonation script, routed from a fake antivirus-renewal notice to a spoofed FBI agent to one of the company’s kiosks. The Chapter 11 filing triggered an automatic stay that freezes that case and pushes it into the bankruptcy court behind the company’s other creditors, which is the mechanical reality of how these wind-downs treat victims. The same logic sits over the lawsuits Iowa and Massachusetts attorneys general had been running against the operator. Insolvency does not just end a business, it caps what the people it harmed can recover from it.

CoinFlip is the test case worth watching, because it is still operating and still arguing for regulation over bans while Bitcoin Depot liquidates. If the second-largest operator can absorb caps, disclosures, and refund obligations across a patchwork of state regimes and stay solvent, the channel survives in a smaller, slower, more boring form that resembles a heavily supervised money transmitter with a physical front end. If it cannot, the state bans are only pulling forward an exit the market was already walking toward. The asset sale running through the Texas bankruptcy will test how much a fleet of nine thousand idle machines is worth once the most lucrative transactions across them have been outlawed, and a buyer is really purchasing retail placements and a brand in a business model the law is busy dismantling.

What collapsed alongside Bitcoin Depot is the framing the sector spent a decade selling. The kiosk was pitched as innovation serving the cash economy, and regulators were asked how to preserve that access without enabling fraud. The data answered a different question, which is whether the access and the fraud were ever separable, and from Iowa to Adelaide the answer was that they were not. The largest operator in North America has now confirmed it the only way a public company can, by switching off nine thousand machines and walking into bankruptcy court rather than running the business under rules built to stop what the business was doing.