The Bitcoin ATM Money Machine: How Retailers Profit While Their Customers Lose Everything

An investigation by ICIJ and CNN found that 90% of CoinFlip ATM transactions were flagged as scam-related by Iowa's attorney general - yet the machines stayed in stores. The anatomy of a legal money laundering pipeline that collected $333 million in fraud fees in 2025 alone.

By CIPHER • BLACKWIRE Investigations • March 17, 2026 • Sources: ICIJ Coin Laundry Investigation, FBI IC3 Report 2024, Iowa Attorney General filings, Bitcoin Depot SEC filings, ChainArgos blockchain analysis

BLACKWIRE graphic. The crypto ATM industry processed an estimated $333 million in scam-related transactions between January and November 2025, according to FBI data.

Steve Beckett was shaking when he walked into the Circle K convenience store in Indiana. He was 66, an ordained minister and volunteer firefighter, and he believed that if he did not convert $7,000 into bitcoin within the next hour, federal agents were going to arrest him for child pornography charges he knew nothing about. His heart was racing. His blood pressure was "through the roof." On the phone, a man named "Josh" kept him calm.

The machine at the back of the store - a Bitcoin Depot ATM - took his cash and converted it to bitcoin in under three minutes. For that service, Bitcoin Depot collected roughly $2,000 in fees. The scammers collected the rest. Beckett never saw his money again.

His story is one of thousands. The FBI received nearly 11,000 fraud complaints involving crypto ATMs in 2024 - a 99% increase from the prior year - representing approximately $247 million in alleged losses. Through November 2025, that figure had already climbed to $333 million. But the machines kept multiplying. As of early 2026, there are nearly 40,000 crypto ATMs operating worldwide, according to Coin ATM Radar, an industry tracker.

What an investigation by the International Consortium of Investigative Journalists and CNN found is not simply that scammers exploit these machines. It is that the companies operating the machines, and the major retailers that host them, have built their business models on top of this exploitation - and that internal data, attorney general filings, and testimony from employees make clear that many of those involved knew exactly what was happening.

BLACKWIRE data graphic. Sources: FBI IC3 2024 Annual Report, Iowa AG v. Bitcoin Depot, Iowa AG v. CoinFlip, Bitcoin Depot SEC filings 2024.

Section I: The Machine at the Back of the Store

Bitcoin Depot's founder and CEO Brandon Mintz installed the company's first ATM in 2016 at a vape shop in Atlanta. His pitch to retailers was simple: a monthly payment, more foot traffic, and the convenience of a crypto machine that sat right next to the regular cash ATM people had been using for years.

Mintz understood he was selling trust. "Once you have a physical machine sitting somewhere next to an ATM that you've used all the time at a store you always go to," he told an Atlanta bitcoin conference in 2019, people stop being skeptical. The ATM's presence in a familiar store implied legitimacy by association. That association became the product.

In the summer of 2021, with bitcoin booming and mainstream adoption accelerating, Bitcoin Depot signed an exclusive agreement with Circle K, one of the largest convenience store chains in North America. According to a former Bitcoin Depot employee, it was "the biggest deal and remains the biggest deal in that space." Circle K's Canadian parent company, Alimentation Couche-Tard, owns both Circle K and Holiday gas stations. By late 2025, Bitcoin Depot operated in approximately 750 Circle K stores across the U.S. and Canada, per SEC filings.

Circle K made millions of dollars off the arrangement. In January 2025 - after complaints had mounted and a district manager had been recorded on police body cam footage saying "I hate these machines, I'd like to get them out of the stores" - Circle K extended its contract with Bitcoin Depot through mid-2026.

One Circle K manager who spoke to ICIJ on condition of anonymity recalled a victim who came back to the store with a sledgehammer and tried to break open the machine to reclaim his money. In one Indiana location, a sign by the register warned clerks against depositing the store's own cash into Bitcoin Depot's machines. The company understood the risk on its own premises and chose not to act.

"If we were to eliminate scams 100%, we would be hurting." - Former Bitcoin Depot employee, speaking to ICIJ on condition of anonymity

Circle K's response to ICIJ was that employees receive training on recognizing common scams, but that they are "not responsible for overseeing customer transactions on Bitcoin Depot ATMs, which are owned and managed solely by third parties." Bitcoin Depot said in a statement that "the vast majority of our customers use our kiosks for legitimate purposes" and that the company "invests heavily in compliance, blockchain monitoring, scam warnings, and partnerships with law enforcement."

In 2024, Bitcoin Depot collected between 15% and 50% of each transaction, according to corporate filings. Its Circle K relationship accounted for nearly a quarter of its entire annual revenue. The math is simple: the more victims deposit, the more Bitcoin Depot earns. The incentive structure is built on the continuation of fraud.

Section II: Iowa Tears Open the Industry

Iowa Attorney General Brenna Bird did not use vague language. In a lawsuit filed against Bitcoin Depot in early 2025, her office wrote that an analysis of transactions conducted in the state on Bitcoin Depot machines between October 2021 and July 2024 showed that more than half involved scams. More than half. Over a three-year period. At the country's largest crypto ATM operator.

But Bitcoin Depot is not the worst case. That distinction belongs to CoinFlip, the second-largest operator. According to court filings in Washington, D.C., prosecutors examining CoinFlip activity in their jurisdiction concluded that approximately 90% of transactions on the network were scam-related. Iowa's attorney general reached similar conclusions examining CoinFlip transactions in the state. CoinFlip told ICIJ it "invests heavily in preventing scams and fraud." Athena Bitcoin, the third-largest operator, which also faced similar findings from D.C. prosecutors, did not respond to requests for comment.

The transaction fee structure makes the problem structural, not incidental. Detective Gerard Lotz of Louisiana, who has investigated many cases involving Bitcoin Depot, told ICIJ: "When we talk to Bitcoin Depot and we talk to these other places, they're insistent that their ATMs are investment machines, that they're for people to make legitimate investments. Yet, I don't know any investment firm anywhere that charges 30%."

The fees these machines charge - commonly between 15% and 30%, with some transactions hitting 50% - are not competitive with any legitimate financial product. They are pricing for a captive user: someone so terrified, confused, or convinced by a scammer that they will pay any premium to complete the transaction quickly, in cash, without a paper trail.

Bitcoin Depot's legal defense is telling. In response to lawsuits, the company argued it "cannot be held liable for the criminal acts of third-party scammers, especially considering the robust warnings and safeguards provided" on its machines. In February 2026, a federal judge sent one of the cases to arbitration - a process widely used to bury corporate liability away from public jury verdicts.

Section III: The Tether Problem - When the Issuer Looks Away

The bitcoin ATM is the physical front end of a much larger financial infrastructure. Once scam victims deposit cash into the machine, their money travels through a chain of cryptocurrency transactions - often ending up in wallets controlled by organized crime networks operating at industrial scale. At the center of this pipeline, in case after case, is USDT: Tether's stablecoin, pegged 1-to-1 to the U.S. dollar, and the preferred currency of criminal operations from Southeast Asian scam compounds to North Korean state hackers.

Tether, now headquartered in El Salvador, is the issuer of the world's most used stablecoin. It holds a unique power in the cryptocurrency ecosystem: it can freeze USDT in specific wallet addresses, stopping dirty money in its tracks. The company has done this before - it announced in early 2026 that its T3 Financial Crime Unit had frozen more than $300 million in criminal assets globally, in partnership with TRM Labs and the TRON blockchain foundation.

But the ICIJ investigation found a stark gap between Tether's stated commitments and its actions in specific, documented cases. The most damaging evidence centers on the Huione Group - a Cambodia-based financial conglomerate that the U.S. Treasury Department's Financial Crimes Enforcement Network (FinCEN) formally identified as a "primary money laundering concern" in May 2025. FinCEN linked Huione to billions of dollars in laundered proceeds, including funds for North Korean hackers and organized crime groups running human trafficking operations and industrial-scale pig-butchering scam networks.

"It is reprehensible that Tether would let so much money flow through a service flagged for money laundering. They should have frozen this." - Erin West, former prosecutor and founder of Operation Shamrock, to ICIJ

A specific Huione wallet address linked to the death of a man in Idaho and the financial destruction of a retiree in San Diego became the focal point of the ICIJ investigation. The wallet transmitted at least $1.4 billion in USDT over a matter of weeks ending in mid-October 2025 - months after FinCEN had publicly named Huione as a money laundering entity. Blockchain analytics firms Chainalysis and TRM Labs - both publicly identified as Tether partners - had labeled the wallet as belonging to Huione Group.

Brad Thorne, a police detective in Boise, Idaho, traced funds from a local suicide victim to that wallet. Kamlesh Mungekar, 54, a San Diego man who lost his retirement savings to scammers, emailed Tether customer support begging the firm to freeze the wallet. "Please help me to recover my lifetime of retirement fund," he wrote. Tether replied that it was "sorry to hear about this unfortunate situation" and was "not in a position to determine the validity of these transfers." The wallet kept moving money.

BLACKWIRE graphic. Jul 2024 - Jul 2025: ICIJ and ChainArgos traced $231M USDT from Huione Group to Binance customer accounts; $35M USDT to OKX accounts. Both exchanges were operating under post-guilty-plea DOJ monitoring during this period.

Section IV: The Exchanges - Post-Plea, Still Processing

If Tether is the liquidity rail, the major centralized crypto exchanges are the exit ramps where dirty money rejoins the financial system. ICIJ's Coin Laundry investigation traced hundreds of millions of dollars worth of USDT from Huione Group wallets to customer accounts at Binance and OKX - the world's two largest exchanges - during periods when both were operating under heightened scrutiny from U.S. law enforcement.

Binance pleaded guilty in November 2023 to operating without adequate anti-money laundering safeguards, paying a $4.3 billion penalty to the U.S. Department of Justice. As part of its plea agreement, the exchange committed to sweeping compliance reforms and agreed to DOJ monitoring. Between July 2024 and July 2025 - months into that monitoring regime - ICIJ's data team, using Arkham Intelligence and Tronscan blockchain data, found that Huione Group wallets sent at least $231 million in USDT to Binance customer accounts.

OKX - formerly OKEx - pleaded guilty in February 2025 to similar charges, paying $504 million. Between February and July 2025, in the immediate aftermath of that plea deal, Huione wallets sent at least $35 million in USDT to OKX customer accounts, according to the same analysis.

The ICIJ methodology used publicly available blockchain data from Arkham and Tronscan, with transactions stored in a PostgreSQL database and cross-referenced with multiple blockchain analytics tools. The analysis focused specifically on customer deposit addresses labeled as belonging to Binance and OKX, tracking two-hop transactions from known Huione Group addresses. The methodology has been made available for independent verification.

Neither Binance nor OKX has publicly responded to the full scope of the ICIJ findings. Tether said it "cannot comment on claims made by third-party analytics firms or ongoing law enforcement investigations" regarding the specific Huione wallet addresses at issue. Chainalysis and TRM Labs both confirmed their attribution of the key wallet address to Huione Group.

"Decisions to freeze wallets are executed in coordination with law enforcement with jurisdiction and are not made unilaterally based on external labeling or speculative attribution." - Tether spokesperson, in statement to ICIJ

The argument is technically defensible. Freezing wallets unilaterally - without law enforcement coordination - could disrupt legitimate users and interfere with active investigations. But the question the investigation raises is different: when Tether's own compliance partners have already labeled a wallet as belonging to a designated money laundering entity, at what point does inaction become a choice?

Section V: The Victims - Who Gets Left Behind

The financial damage is enormous. The human damage is worse.

Brad Thorne, the Boise detective, described tracking funds from a local man who took his own life after losing large sums to scammers who routed the money through Huione's wallet. "It's the embarrassment, the shame of it all," Thorne said. "He'd been a community leader his whole life and I think that was too much for him to take."

Kamlesh Mungekar, the San Diego retiree, described the experience of being scammed as a complete psychological capture. His scammers posed as New Delhi police investigators, then threatened him with jail time if he did not cooperate. They walked him through liquidating his retirement accounts, converting the funds to cryptocurrency, and sending everything to a wallet. He lost over a million dollars. "They completely hijacked my brain," he told ICIJ. "I was under a lot of stress." When he emailed Tether begging for help, the response he received was a form letter. He has since filed a report with California's attorney general.

Steve Beckett, the Indiana minister who lost $7,000 at the Circle K Bitcoin Depot machine, put it plainly: "That money was our livelihood. That's how we were living. Paying for things, paying for bills, paying for our mortgage, buying our daughters stuff for their birthdays for Christmas. We can't do any of that." He is now suing Bitcoin Depot. A federal judge has sent the case to arbitration.

The victims are not random. Crypto ATM scams disproportionately target older Americans, who are more likely to respond to authority-figure impersonation schemes - fake IRS agents, fake bank fraud investigators, fake federal marshals. The FBI data shows the vast majority of reported victims are over 60. Many lose their entire life savings in a single afternoon.

Recovery is functionally impossible. Blockchain transactions are irreversible by design. The scammer wallets move funds through mixers, chain-hops, and intermediary addresses within minutes of receipt. By the time a victim calls the police, the money is already fragmented across dozens of wallets and multiple blockchains. Law enforcement can trace the path - blockchain analysis has become remarkably sophisticated - but tracing is not recovering. The detective can tell you where your money went. He cannot get it back.

Section VI: Timeline - From Boom to Reckoning

Section VII: The Regulatory Gap and Who Fills It

The legal framework governing crypto ATMs has never caught up with the industry's growth. For years, operators argued - successfully - that they were not money transmission businesses in the traditional sense, and therefore not subject to the same Bank Secrecy Act requirements that apply to banks, wire transfer services, and traditional money services businesses. Enforcement has been fragmented, left largely to state attorneys general rather than a coherent federal framework.

The passage of the Genius Act in 2025 marked the first major federal attempt to regulate stablecoins, affirming that issuers operating in the U.S. must comply with federal AML rules. But the Act left unaddressed many of the practical questions around stablecoin compliance at the individual transaction level - including the question of when an issuer is obligated to act when its own analytics partners have flagged a wallet as criminal.

The crypto ATM sector specifically operates under Financial Crimes Enforcement Network registration requirements, but critics say these have been enforced selectively and inconsistently. The Iowa AG actions against Bitcoin Depot and CoinFlip represent the most aggressive state-level intervention to date. Other states have moved more slowly.

Meanwhile, the machines have continued to proliferate. Coin ATM Radar tracked 39,000 machines globally in early 2025. The number keeps rising despite - and in some ways because of - regulatory uncertainty. Operators know that the window before serious federal action may be short, and they are maximizing revenues while it remains open.

Consumer advocates have pushed for mandatory scam warnings on machine screens, mandatory cooling-off periods for large transactions, mandatory reporting of suspicious transaction patterns, and stricter liability standards for retail hosts. The industry has lobbied against each of these. Bitcoin Depot told the SEC in its public filings that "additional regulatory requirements" represent a material business risk. That is accurate. Effective regulation would cut into the portion of the revenue base that comes from scam transactions.

"When we talk to Bitcoin Depot and we talk to these other places, they're insistent that their ATMs are investment machines, that they're for people to make legitimate investments. Yet, I don't know any investment firm anywhere that charges 30%." - Gerard Lotz, police detective, Louisiana, to ICIJ

The U.S. Consumer Financial Protection Bureau (CFPB) has jurisdiction over non-bank financial products and has previously taken action against payday lenders and prepaid card issuers for practices that preyed on vulnerable consumers. Several consumer law experts who spoke to ICIJ suggested that the crypto ATM industry's documented targeting of elderly fraud victims could qualify for CFPB enforcement action under the Dodd-Frank Act's prohibition on "unfair, deceptive, or abusive acts or practices." As of early 2026, no such action had been taken.

Section VIII: The Full Picture - A Legal Money Laundering Ecosystem

Lay it out plainly. A scammer in a Southeast Asian compound, or Nigeria, or Eastern Europe, identifies a target - usually elderly, usually isolated, usually with savings. They use a script refined by years of testing. They create terror - federal charges, frozen accounts, criminal records, family scandal. Then they walk the victim to a specific machine. The victim feeds in cash. The machine converts it to bitcoin at a 30% premium. Bitcoin Depot gets its cut. Circle K gets its monthly payment. The bitcoin moves through a sequence of wallet addresses. Some of that path runs through Huione Group-controlled addresses, some through "crypto-to-cash desks" - anonymous conversion services requiring no identity checks. Eventually the value reaches a centralized exchange - Binance, OKX, others - where it enters customer accounts, gets traded for other assets, and disappears into the global financial system.

Every link in this chain is aware, to varying degrees, of what it is facilitating. The machine operator knows its transaction data. The retail host hears from its own employees. The stablecoin issuer has analytics partners who label the destination wallets. The exchanges have compliance departments and post-plea DOJ monitors. The blockchain is public. None of the data is hidden.

What is missing is not information. What is missing is the financial incentive to act, and the legal compulsion to act when the financial incentive is absent.

Tether earned approximately $13 billion in profit in 2024, according to the company's own disclosures - a 99% profit margin driven by interest on the Treasury bonds backing its USDT reserves. Bitcoin Depot's Circle K relationship alone accounted for roughly 25% of its annual revenue. CoinFlip, despite having 90% of its Iowa transactions flagged as scam-related, remained the second-largest operator in the country.

Kamlesh Mungekar saved his entire working life to build a retirement. A team of professional scammers, a crypto machine in a convenience store, a stablecoin issuer that chose not to freeze one wallet, and two post-conviction exchanges that did not stop the deposits - together, in the span of a few weeks, turned that retirement into nothing. He sent Tether an email. They sent him a form letter. He filed a complaint with California's attorney general.

The machines are still in the stores. The contracts have been renewed. The fees keep collecting.