Maine Secures $1.9M Restitution From Bitcoin Depot, Grants License as Crypto ATM Fraud Scrutiny Rises

Maine just drew a line in the sand for crypto kiosk operators: repay victims and meet state standards or don’t operate. After a two-year investigation, the Maine Bureau of Consumer Credit Protection struck a $1.9 million settlement with Bitcoin Depot to compensate residents who were defrauded by third-party scams executed through the company’s machines. As part of the deal, the state granted Bitcoin Depot a money transmitter license. Notably, Maine still doesn’t appear among the company’s active locations online.

The core signal here is a “restitution-for-license” model. Rather than simply banning machines, Maine is forcing accountability at the point of conversion—where cash becomes crypto—and tying continued market access to consumer protection. The governor framed the move around returning funds to residents and encouraged families to discuss how to avoid increasingly polished frauds. That messaging matters: it shifts the narrative from blaming victims to setting expectations for operators.

The problem set is large and growing. FBI data show Americans reported $246 million in crypto ATM-related losses in 2024—up 99% year over year—with about 43% involving people over 60. Scammers often push victims to withdraw cash, convert at a kiosk, and send crypto to impostors posing as officials, businesses, or tech support. With more than 30,000 crypto kiosks in the U.S., the attack surface is wide.

Regulatory pressure is now consistent across jurisdictions: - State actions: Attorneys general in Iowa and Washington, D.C., have sued major operators—Bitcoin Depot and CoinFlip in Iowa, and Athena Bitcoin in D.C.—alleging hidden fees and weak consumer protections. - Federal push: Sen. Dick Durbin introduced legislation last year to cap transaction sizes and require refunds for scam victims. - Maine’s own rulebook: Emergency legislation enacted in June—“An Act to Regulate Virtual Currency Kiosks”—limits daily transaction amounts, caps fees, and creates consumer recourse. - Abroad: New Zealand banned crypto ATMs outright; the UK forces operators to register with the FCA, which has yet to approve any.

Bitcoin Depot, founded in 2016 and now led by President Scott Buchanan following founder Brandon Mintz’s departure as CEO at the start of this year, operates more than 9,000 kiosks across North America, with additional machines in Australia, Canada, Hong Kong, and Mexico. Under Maine’s agreement, the company must fully comply with state consumer protection laws. The firm has been asked to comment.

What should operators actually change? The weak link is the irreversible, high-friction handoff from cash to on-chain funds. A viable compliance stack for kiosks looks like this: - Hard caps and cooling-off: Daily limits paired with session-based delays for first-time users or high-risk flows. Even a two-hour pause disrupts scam scripts that rely on urgency. - Real fee transparency: On-screen, pre-transaction dollar and percentage fees, plus FX spread disclosure. Hidden spreads are where reputational risk compounds. - Behavioral safeguards: Real-time prompts that detect common scam phrases and patterns (e.g., “court warrant,” “tech support,” “gift card reimbursement”) and require users to attest they are not sending to an unknown party or government agent. - Velocity and geofencing controls: Dynamic limits by location/time, with enhanced due diligence on repeat or clustered usage typical of mule activity. - Refund pathways: While blockchains are final, kiosk operators control initiation. Reversible pre-send staging—escrow-like holds for flagged transactions—creates a window to intervene without undermining Bitcoin’s settlement layer.

Critics argue these measures cut into convenience and margins. They do. But the alternative is litigation, fee caps, and outright bans. The kiosk business—already a tight spread model reliant on route density—will face higher compliance costs. Expect consolidation: operators that can industrialize fraud controls, upgrade UX, and engage regulators will survive; smaller players may exit or be acquired.

There’s also an ethical tension that can’t be ignored. Kiosks bring cash-based users into crypto without bank gatekeepers, which many people value. At the same time, older Americans are frequently targeted, and opaque pricing plus instant finality is a poor design for vulnerable users. Better defaults—slower settlement for risky flows, clearer warnings, and simple refund processes—respect user autonomy while reducing harm.

Maine’s approach won’t end crypto ATM scams, but it reframes accountability. If more states replicate the license-for-restoration trade, and if federal caps and refund obligations advance, the U.S. could standardize kiosk operations without erasing access. The next 12 months likely decide whether the sector matures into a regulated cash-to-crypto onramp—or shrinks under the weight of preventable fraud.