It sounds like a simple transaction: walk up to a machine, insert cash, and walk away with Bitcoin in your digital wallet. No bank. No paperwork. No waiting. But for over 10,956 people in 2024, that convenience turned into a nightmare. They lost $246.7 million - all because they trusted a crypto ATM.
These machines, officially called convertible virtual currency (CVC) kiosks, are everywhere now. From strip malls to gas stations, they promise quick access to cryptocurrency. But behind the sleek screens and easy buttons lies a dangerous loophole: almost no oversight. Unlike traditional ATMs, which are monitored by federal rules and backed by banks, crypto ATMs operate in a gray zone. Many don’t verify your identity. They don’t report suspicious activity. And once you send money out? It’s gone forever.
How the Scams Work
Scammers don’t need to hack a system to steal from crypto ATMs. They just need to trick you.
Here’s how it usually goes:
- You get a call from someone claiming to be from the IRS, police, or even your grandchild. They say you’re in trouble - arrested, in danger, or facing deportation.
- To fix it, you’re told to buy Bitcoin at the nearest crypto ATM and send it to a wallet address they give you.
- You follow the steps. The machine asks for cash. You insert it. The Bitcoin is sent. No receipt. No trace.
- By the time you realize it’s a scam, the money is already on the blockchain - irreversible, untraceable, and gone.
The FBI reports that more than two-thirds of victims in 2024 were over 60. Seniors are targeted because they’re often less familiar with crypto, more trusting of authority figures, and less likely to report the crime out of shame.
One Arizona family lost nearly $1 million in a single year. In Scottsdale, police recorded $5 million in losses just this year. These aren’t outliers - they’re the tip of the iceberg.
Why Crypto ATMs Are So Dangerous
Traditional ATMs have layers of protection: PINs, surveillance, transaction limits, fraud detection algorithms, and bank-backed refunds. Crypto ATMs? Not even close.
The National Consumers League calls them “largely unregulated.” Many operators don’t register as money services businesses (MSBs), which means they skip critical steps like Know Your Customer (KYC) checks. No ID. No records. No accountability.
And it’s not just social engineering. Some machines have real, exploitable software flaws.
In March 2024, security firm IOActive found three critical vulnerabilities in the Lamassu Douro Bitcoin ATM. One flaw - CVE-2024-0674 - lets a criminal with physical access to the machine gain full control by dropping a single malicious file into its system. Once inside, they can install malware, steal user data, or even redirect transactions. And this isn’t a one-off. Similar vulnerabilities exist in other models.
That means a scammer doesn’t even need to trick you. They could just walk up, plug in a device, and steal money from multiple users without you ever knowing.
Arizona’s Bold Response
While federal agencies like FinCEN and the FBI have issued warnings, real change is happening at the state level.
Arizona - home to over 600 crypto ATMs - became the first state to pass a targeted law in 2025. Under the new Cryptocurrency Kiosk License Fraud Prevention Act:
- New customers can only withdraw $2,000 per day.
- Existing customers are capped at $10,500 per day.
- Every transaction must display a warning screen that users must actively confirm before proceeding.
- Operators must refund the full amount - including fees - to any new customer who reports fraud within 30 days.
It’s not perfect. Enforcement is still weak. Many operators still ignore the rules. But it’s the first real attempt to put limits on an otherwise wild-west system.
Other states are following. In 2025, at least 11 states passed laws specifically targeting crypto ATMs. Over 40 states introduced some form of crypto regulation that year. The message is clear: this isn’t a tech problem. It’s a public safety crisis.
The Bigger Picture: Irreversible Transactions
What makes crypto ATMs so attractive to criminals isn’t just the lack of regulation - it’s how cryptocurrency itself works.
Once you send Bitcoin or Ethereum, you can’t undo it. Credit cards have chargebacks. Bank transfers can be recalled. PayPal has dispute teams. Crypto? No. Once it’s sent, it’s gone. And because blockchain is anonymous, law enforcement can’t track who got the money.
FinCEN’s 2025 notice to financial institutions warned that these machines are now a top tool for transnational crime rings. Drug cartels, ransomware gangs, and human traffickers use them to launder money because they’re fast, cheap, and silent.
Even experts who support cryptocurrency admit the problem. James Wyler of Trusted Security Solutions says crypto ATMs are part of a broader trend: financial tools built for innovation, not protection. “We’ve created systems that prioritize speed over safety,” he said. “And now we’re paying the price.”
What You Can Do
If you’re thinking of using a crypto ATM - or if someone you care about is being pressured to use one - here’s what to remember:
- Never send crypto to someone you don’t know. Not even if they say they’re from the government.
- Ask for ID. Legitimate operators will show you their license. If they can’t, walk away.
- Check the machine. Is it in a well-lit, busy area? Is there a camera? Is the brand recognizable? (Lamassu, General Bytes, and BitAccess are among the few with known security standards.)
- Set limits. If you must use one, start with small amounts. Don’t let anyone talk you into sending thousands.
- Report it. If you’re scammed, file a report with the FBI’s IC3 at ic3.gov. Even if you don’t get your money back, your report helps law enforcement track patterns.
And if you’re helping an older relative - don’t just warn them. Sit with them. Show them a real scam call. Practice saying “no.” Scammers prey on isolation. Connection is your best defense.
The Future: Can Crypto ATMs Be Fixed?
There’s no easy fix. Cryptocurrency was built to be decentralized. That’s its strength - and its flaw.
Some companies are trying. A few newer ATMs now include biometric verification and real-time fraud alerts. Others are working with FinCEN to integrate transaction monitoring. But these are exceptions, not the norm.
The real solution? Regulation. Not just patchwork laws - but clear, enforceable federal standards. Mandatory KYC. Real-time reporting. Transaction limits. Refund windows. And penalties for operators who ignore the rules.
Until then, crypto ATMs remain a trap disguised as technology. They’re not tools for financial freedom. They’re open doors for criminals. And the $246.7 million lost in 2024? That’s just what we know about.
Behind every number is a person. A grandparent. A retiree. Someone who trusted a machine - and lost everything.
Are crypto ATMs legal?
Yes - but with big gaps in oversight. While federal law requires operators to register as money services businesses (MSBs), many don’t. Some states have started enforcing rules, but there’s no national standard. That means legality doesn’t equal safety.
Can you get your money back if you’re scammed through a crypto ATM?
Almost never. Cryptocurrency transactions are irreversible by design. Arizona’s new law is the only exception - it requires operators to refund new customers who report fraud within 30 days. But this only applies in Arizona, and only if the operator follows the law. In most places, once the crypto is sent, it’s gone for good.
Why are seniors targeted so often?
Seniors are targeted because they’re more likely to trust authority figures, less familiar with crypto, and less likely to report fraud out of embarrassment. The FBI found over 70% of 2024 victims were over 60. Scammers use fear tactics - fake arrests, medical emergencies, grandchild crises - knowing seniors will act quickly to help.
Do crypto ATMs require ID?
It depends. Some require ID, especially for larger transactions. But many don’t - especially older or poorly regulated machines. The lack of consistent ID checks is one of the main reasons scammers prefer them over banks.
How many crypto ATMs are there in the U.S.?
As of early 2026, there are over 40,000 crypto ATMs operating across the U.S. Arizona, Texas, and Florida have the highest concentrations. The number has grown by over 30% since 2024, even as fraud reports have skyrocketed.
Can crypto ATMs be hacked remotely?
Yes - and it’s easier than you think. Security researchers found that machines like the Lamassu Douro have critical software flaws that allow attackers to gain full control with physical access. A single malicious file can give them root access to install malware, steal data, or redirect transactions. Remote hacking is less common, but not impossible - especially if the machine is connected to an insecure network.
