(21) Commitments and Contingencies

Litigation

From time to time in the regular course of its business, the Company is involved in various lawsuits, claims, investigations and other legal matters. Except as noted below, there are no material legal proceedings pending or known by the Company to be contemplated to which the Company is a party or to which any of its property is subject. The Company believes that adequate provisions for resolution of all contingencies, claims and pending litigation have been made for probable losses that are reasonably estimable. These contingencies are subject to significant uncertainties and the Company is unable to estimate the amount or range of loss, if any, in excess of amounts accrued. The Company does not believe that the ultimate outcome of these actions will have a material adverse effect on its financial condition but could have a material adverse effect on its results of operations, cash flows or liquidity in a given year.

On November 24, 2025, the Company announced a ruling in an arbitration proceeding involving its Canadian subsidiary, BitAccess, Inc. (“BitAccess”), a Canadian corporation acquired by Bitcoin Depot in 2021. The

 

underlying claims were brought in arbitration by Cash Cloud, Inc., a Nevada corporation (“Cash Cloud”) on August 16, 2022, under the rules of the Canadian Arbitration Association. The claims brought by Cash Cloud allege breaches of the 2020 Master Purchase Agreement between BitAccess and Cash Cloud including alleged performance failures of BitAccess hardware and software.

Following arbitral hearings that were held in December 2024, and in March, April and October 2025, the arbitral tribunal recently issued its award in favor of Cash Cloud in the amount of $18.5 million. The award represents the full amount of damages found by the tribunal based on Cash Cloud’s claims asserted in the arbitration. BitAccess intends to continue to vigorously defend this matter. BitAccess is seeking to have the award set aside, however, we cannot predict with any degree of certainty the ultimate outcome of the matter. The Company has accrued $18.5 million in respect of the arbitration ruling.

The Company intends to vigorously defend the U.S. Bankruptcy Court action, and believes that it substantially overlaps with the issues already before the Canadian arbitral tribunal. Cash Cloud is seeking damages in the amount of $18.5 million in the U.S. Bankruptcy Court action.

The allegations in the U.S. Bankruptcy Court litigation arise from the same operative facts as the Canadian arbitration and involve the same agreement, the same alleged breaches, and similar claimed damages. We believe that a ruling in the Canadian arbitration—particularly on the scope of the agreement, BitAccess’ contractual obligations, causation, and damages—may limit, make moot, or otherwise materially affect the U.S. Bankruptcy Court proceeding. The Company expects the Canadian forum to be the primary forum for resolution of the dispute.

On February 3, 2026, Bitcoin Depot Operating LLC and the Company were made aware of a civil complaint from the Attorney General of the Commonwealth of Massachusetts (the “Massachusetts AG”) in connection with a suit filed against the Company in the Superior Court of the Commonwealth of Massachusetts for Suffolk County. The complaint alleges that the Company violated certain provisions of the Massachusetts Consumer Protection Act, Chapter 93A, in connection with the operation of the Company’s cryptocurrency kiosks in Massachusetts.

The complaint alleges, among other things, that the Company engaged in unfair or deceptive acts or practices relating to the pricing and disclosure of fees associated with kiosk transactions, charged excessive or undisclosed markups, failed to take sufficient steps to prevent its kiosks from being used by customers in connection with fraudulent schemes, and did not adequately assist customers who reported being victims of fraud. The complaint further alleges that the Company knew or should have known that certain transactions conducted at its kiosks were associated with fraudulent activity and that additional safeguards should have been implemented. The Massachusetts AG also alleges that Bitcoin Depot Inc. failed to disclose material information to investors concerning the alleged extent to which fraudulent transactions occurred at the Company’s kiosks.

The Company intends to vigorously defend the matter although there can be no assurance as to the outcome. A reasonable estimate of the amount of any possible loss or range of loss cannot be made at this time.

 

 

Following an investigation into Bitcoin Depot’s kiosk activity, the Maine Bureau of Consumer Credit Protection (BCCP), with assistance from the Maine Attorney General, resolved its concerns with Bitcoin Depot’s practices in early December 2025. As part of the resolution, BCCP entered into an agreement with Bitcoin Depot which required Bitcoin Depot to pay $1.9 million that will be used establish an account and facilitate payments directly to certain Maine consumers who submit verifiable claims to the OAG that they have suffered loss and harm as a result of third-party actors. The Company accrued the amount in other (expense) income on the Consolidated Statements of Income. As of the date of this report the investigation has been resolved.

On January 13, 2023, Canaccord Genuity Corp. (“Canaccord”) commenced proceedings against the Company by filing a claim with the Superior Court of Justice in Toronto, Ontario which named Lux Vending, LLC and Bitcoin Depot LLC as the defendants. Canaccord is a financial services firm in Canada that the Company previously had hired to perform advisory services related to a potential initial public offering in Canada or sales transaction. The claim asserts that Lux Vending, LLC breached the contract by terminating the contract to avoid paying fees for their services and that Canaccord is entitled to $23.0 million in damages equivalent to the fees alleged to be payable for breach of contract that would have been owed upon the closing of a transaction to acquire control, the sale of substantially all the Company’s assets, or a merger transaction pursuant to the previously terminated engagement letter for advisory services. Canaccord proposes that the amount of fees would be calculated on the total cash transaction value of the business combination of $880.0 million. The claim also seeks an award for legal and other costs relating to the proceeding.

In 2024 Canaccord added Bitcoin Depot Operating LLC as a defendant to account for the name change following the closing of the merger. Canaccord now estimates the total transaction value could be up to $655 million.

Bitcoin Depot does not believe the allegations made against it are valid and intends to vigorously defend against them. The range of potential loss related to the identified claim is between $0 and $23.0 million, the amount of damages that Canaccord is seeking in the lawsuit. The additional costs mentioned in the claim are not able to be estimated at this time. The discovery phase of the litigation involving documentary productions and oral examinations is largely completed. Mediation produced no resolution to this matter and trial is set to begin in 2027.

In March 2025, two of our subsidiaries were served with a civil complaint from the Attorney General of the State of Iowa (the “Iowa AG”) in connection with a suit filed against us by the Iowa AG, on behalf of the state of Iowa, in the Iowa District Court for Polk County. The complaint alleges that our subsidiaries violated certain provisions of the Iowa Consumer Fraud Act as a result of Bitcoin withdrawals made from our ATMs being used by our customers to make payments under a variety of fraudulent schemes. The complaint further alleges that Bitcoin Depot should have known that the purpose of these withdrawals was to make payment under such schemes and that it should have taken additional steps to protect its customers. The complaint is seeking a preliminary and permanent injunction against the subsidiaries from either operating in Iowa or further violating the Iowa Consumer Fraud Act as well as monetary penalties. Iowa AG has not sought or been granted injunctive relief. The Company filed its Answer on April 17, 2025.The Company served its discovery requests to the Iowa AG and their responses are July 23, 2025. Due to a system issue, the Iowa AG requested an extension to provide its discovery response which the Company received July 30, 2025. The Iowa AG has not yet served its discovery request on the Company. The Company strongly rejects any allegations that its subsidiaries or their BTMs violated the Iowa Consumer Fraud Act and intends to vigorously defend itself against the allegations. While we

 

believe that the Iowa AG is misinterpreting the related act and we have other strong defenses, we cannot assure you of the ultimate outcome of the claim. Although the Company does not believe that this matter will have a material adverse effect on its business, financial position, results of operations or cash flows, the Company can provide no assurance as to the scope and outcome of this matter and no assurance as to whether there will be a material adverse effect to its business or its Consolidated Financial Statements. A reasonable estimate of the amount of any possible loss or range of loss cannot be made at this time.

The Company, through its subsidiary Digital Gold, is currently defending an arbitration brought by Moe Adham, individually and as the representative of the minority shareholders of BitAccess Inc. (collectively, the “Claimant”). The minority shareholders collectively hold 20% of BitAccess (the “MSI”) and Digital Gold owns the remaining 80%. The arbitration is taking place before retired Supreme Court of Canada Justice Thomas Cromwell.

The Claimant alleges that Bitcoin Depot’s June 30, 2023 closing of its business combination with GSR II Meteora Acquisition Corp. (the “GSR Transaction”) constituted a “Parent Liquidity Event” (“PLE”) under the BitAccess Shareholders Agreement (“SHA”). If a PLE occurred, the minority shareholders contend they were entitled to exercise a contractual Put Right requiring Digital Gold to purchase their shares at fair market value as of June 30, 2022. The Claimant asserts breach of contract, misrepresentation, estoppel, oppression, and constructive dismissal, and seeks damages or a buyout valued at approximately $10.4 million.

Bitcoin Depot disputes that the GSR Transaction constituted a PLE under the SHA and maintains that the minority shareholders never exercised the Put Right. The Company also contests the arbitrator’s jurisdiction over the oppression and employment-related claims. Even if a PLE had occurred, Bitcoin Depot asserts that any damages are limited to $4.444 million, consistent with an independent valuation prepared by Alvarez & Marsal in 2022 pursuant to the SHA. The Claimant challenges that valuation, asserting that it relied on information not knowable as of the valuation date, which Bitcoin Depot denies.

The arbitration arises from events following Bitcoin Depot’s acquisition of 80% of BitAccess in 2021 and the parties’ 2022 agreement to fix the valuation date for any PLE at June 30, 2022, as BitAccess was transitioning from its historic revenue model and anticipating the loss of a major customer. The minority shareholders later disputed the Alvarez valuation, and the parties engaged in settlement discussions in 2023 and 2024; however, no agreement was reached.

The matter is currently in the evidentiary phase. Bitcoin Depot has produced relevant documents and received the Claimant’s productions. Based on information available to date, the Company believes it has strong defenses on the central PLE issue and continues to assess potential exposure following receipt of the Claimant’s forthcoming evidence.

The Company intends to vigorously defend the matter, but there can be no assurance as to the outcome, and as such no liability has been recorded. The range of potential loss related to the identified claim is between $0 and $10.4 million, the amount of damages that are being sought in the lawsuit.

On August 5, 2025, Bitcoin Depot Inc. (the “Company”) received notice that a class action lawsuit was filed in the U.S. District Court for the Northern District of Georgia. The complaint, brought by a Georgia resident on behalf of a proposed nationwide class and Georgia subclass, alleges that the Company failed to adequately safeguard, monitor, and protect the personally identifiable information (“PII”) of approximately 27,000

 

 

customers, which was allegedly compromised in a data breach discovered in June 2024. At that time, law enforcement requested Bitcoin Depot not publicly disclose the data breach until it completed its investigation. In July 2025, law enforcement lifted its hold and Bitcoin Depot provided notice to the potentially impacted consumers.

The complaint asserts eight causes of action, including negligence, negligence per se (based on alleged violations of FTC guidelines), invasion of privacy, breach of implied contract, unjust enrichment, breach of fiduciary duty, and violations of Georgia’s Uniform Deceptive Trade Practices Act and attorneys’ fees statute. The plaintiff seeks actual and compensatory damages, equitable and injunctive relief, credit monitoring for at least three years, restitution, disgorgement, punitive damages, attorneys’ fees, and class certification. On October 27, 2025, the Company filed a Motion to Dismiss the Plaintiff’s Complaint in its entirety on several grounds including lack of standing, failure to allege concrete harm, and lack of causation.

On March 9, 2026, the Connecticut Department of Banking, Consumer Credit Division, issued an Order and Notice of Summary Suspension, Temporary Order to Cease and Desist, Order to Make Restitution, Order to Provide Disgorgement, Notice of Intent to Revoke and Refuse to Renew Money Transmission License, Notice of Intent to Issue Order to Cease and Desist, Notice of Intent to Impose Civil Penalty, and Notice of Right to Hearing (the “Order and Notice”) to Bitcoin Depot Operating LLC (“OpCo”). The Department summarily suspended OpCo’s license to engage in the business of money transmission in the State of Connecticut pending proceedings for revocation and refusal to renew. Unless set aside or modified by a court, the Temporary Order to Cease and Desist shall remain in effect until the effective date of a permanent order or dismissal of the matters asserted in the Order and Notice. The Department alleges that OpCo’s conduct materially prejudiced the interests of consumers and that OpCo failed to maintain the required minimum tangible net worth in 2022 and 2023. OpCo’s request to renew its money transmission license in Connecticut is pending. OpCo has a right to request a hearing on the Order to Make Restitution, Order to Provide Disgorgement, Notice of Intent to Revoke and Refuse to Renew Money Transmission License, Notice of Intent to Issue Order to Cease and Desist and Notice of Intent to Impose Civil Penalty.

On March 9, 2026, in compliance with the Order and Notice, OpCo suspended operations at all kiosks located in the State of Connecticut. This matter is in its very early stages. OpCo intends to vigorously defend the matter although there can be no assurance as to the outcome. A reasonable estimate of the amount of any possible loss or range of loss cannot be made at this time.

In 2025, fourteen states passed legislation to regulate use of virtual currency kiosks. We cannot predict the full impact these laws, or any similar pending or future legislation, may have on our financial condition or results of operations, nor can we predict the likelihood of such bills becoming law.

pre-trial

year-end,

 

We are also party to various other legal proceedings and claims in the ordinary course of our business. We believe these other matters will not have a material adverse effect on our consolidated financial position, results of operations or liquidity.

non-U.S.