California Hits CoinFlip With $4.8M Penalty Over Crypto ATM Fraud

The regulatory environment for crypto-adjacent infrastructure is tightening, with California’s Business and Consumer Services Agency issuing a sharp rebuke to one of the industry's largest players. The state has ordered Chicago-based CoinFlip to pay $4.8 million in restitution to victims of fraud perpetrated through its network of machines. The enforcement action, announced Thursday, centers on allegations that the company failed to implement adequate safeguards—specifically, failing to detect, prevent, and report suspicious activity—over the last five years. For a company that markets itself as the world’s largest crypto ATM network by volume, this represents a significant operational and reputational liability.

CoinFlip operates approximately 5,500 bitcoin ATMs globally, with roughly 500 of those located in California, typically housed in convenience stores, gas stations, and grocery outlets. The California Department of Financial Protection and Innovation (DFPI) argued that the company’s business model—which facilitates immediate, irreversible, and difficult-to-trace transactions—has become a preferred conduit for bad actors. According to the state agency, these kiosks have been used to exploit consumers, particularly older Americans, by luring them into transferring funds under false pretenses. The $4.8 million penalty is framed as a direct consequence of these systemic failures.

This enforcement action is notable for its explicit commentary on the shifting landscape of federal versus state oversight. Rohit Chopra, who now leads California's agency following his tenure as head of the Consumer Financial Protection Bureau (CFPB), used the announcement to criticize federal regulatory trends. With the current federal administration moving to scale back the CFPB’s scope and reverse policies regarding emerging digital financial services, Chopra characterized the state's move as a necessary intervention. He stated that while federal regulators may be offering a “free pass” to consumer-facing crimes, California is choosing to diverge, focusing on holding bad actors accountable for how their technology is deployed.

From a fintech perspective, the case against CoinFlip underscores the regulatory exposure inherent in operating physical cash-to-crypto infrastructure. While these companies often operate under the umbrella of 'fintech,' this incident highlights the friction between software-enabled financial access and the compliance burdens required to mitigate financial crime. As states increasingly take the lead on consumer protection in the absence of aggressive federal enforcement, operators in the crypto kiosk space face heightened scrutiny regarding their know-your-customer (KYC) and anti-money laundering (AML) protocols. The ability to verify transactions and prevent illicit flows is no longer just a regulatory box-ticking exercise; it is a fundamental risk to the business model.

CoinFlip has not yet responded to requests for comment regarding the order. The company, founded in 2015, has scaled rapidly across 48 U.S. states, but this enforcement action suggests that rapid expansion without commensurate compliance infrastructure creates significant liability. As California continues to position itself as a consumer watchdog, the state’s aggressive posture may serve as a bellwether for how other jurisdictions handle the intersection of physical crypto access points and financial fraud. For investors and stakeholders, the incident serves as a reminder that regulatory scrutiny is moving beyond the software layer and directly into the physical infrastructure of the crypto economy.