Missouri Attorney General Catherine Hanaway filed suit on May 20 against GPD Holdings LLC, the Chicago-based company that operates under the name CoinFlip, alleging its network of more than 140 crypto kiosks across the state enabled a systematic pattern of consumer fraud. The lawsuit, filed under the Missouri Merchandising Practices Act, seeks nearly $1.83 million in civil penalties, a full ban on CoinFlip's operations in Missouri, and direct restitution for defrauded consumers.

CoinFlip describes itself as the world's largest cryptocurrency ATM network by transaction volume. Its machines sit in convenience stores, gas stations, liquor stores, and vape shops across Missouri and the wider United States. The complaint implies the placement is not incidental. "Bitcoin and crypto ATMs are the new getaway cars for fraud, whisking away innocent people's money to scammers, never to return," Hanaway said in the filing announcement. The Missouri State Highway Patrol and the St. Louis Fusion Center documented 350 crypto ATM fraud cases in the state over just two years, providing the evidentiary foundation for the complaint.

The lawsuit targets a specific mechanic that regulators say makes crypto ATMs more dangerous than ordinary financial products: once a transaction is confirmed on the blockchain, it cannot be reversed. Scammers running romance schemes, government-impersonation cons, or fake investment offers routinely direct victims to crypto ATMs precisely because of this irreversibility, combined with the pseudonymous nature of wallet addresses. Victims skew older, with seniors identified as the disproportionately affected demographic. The Federal Trade Commission found that seniors' losses from crypto payment fraud rose roughly 20-fold since 2020. In the first half of 2024 alone, reported US losses tied to crypto ATMs exceeded $65 million.

The fee structure compounds the harm. CoinFlip's own published rates sit between roughly 7 and 10 percent for purchases. Iowa Attorney General Brenna Bird, who filed simultaneous suits against both CoinFlip and Bitcoin Depot, told a different story. Her office subpoenaed 14 crypto ATM companies beginning in October 2023 and found that CoinFlip was effectively charging around 21 percent per transaction, with the markup embedded in the exchange rate rather than displayed as a transparent line-item fee. Bitcoin Depot's effective rate came in near 23 percent. Iowa estimates its residents lost more than $20 million through the two operators over a period of under three years. CoinFlip called Hanaway's lawsuit "meritless" and said the company had "championed the law that protects Missourians" from criminal scammers.

The broader data reinforces why both states moved now. FBI figures covering January through November 2025 recorded more than 12,000 complaints linked to crypto kiosks, totaling $333.5 million in losses. The first half of 2025 alone produced roughly $240 million in losses. Reporting sources vary in whether individual figures capture US-only or global activity, making direct year-over-year comparisons across data sets imprecise, but the directional trend across all available figures points sharply upward. A federal bill, the Crypto ATM Fraud Prevention Act of 2025 (S.710), is working through the 119th Congress and would impose a 14-day onboarding period for new users, cap daily transactions at $2,000, set a cumulative ceiling of $10,000, and require verbal confirmations for transfers above $500. It has not yet passed.

The implications extend well beyond Missouri and Iowa. In Kenya, crypto ATM operators began installing machines in Nairobi malls within weeks of the country's VASP Bill being enacted, even as regulators flagged unlicensed operations. Kenya processed approximately $3.3 billion in digital assets in the year to June 2024. Nigeria, ranked sixth globally for crypto adoption in the 2025 Chainalysis Global Crypto Adoption Index, has seen rapid ATM growth driven by demand for alternative financial infrastructure. The Missouri and Iowa cases establish a consumer protection argument, grounded not in securities law but in basic merchandising statutes, that regulators in those regions could adapt using existing legal frameworks without waiting for crypto-specific legislation.

The Missouri investigation itself grew from a broader inquiry Hanaway launched in December 2025 covering multiple crypto ATM operators. For operators currently expanding in Africa and South Asia, the pattern from Missouri is instructive: the complaint argues that inadequate fee disclosure, combined with demonstrated consumer harm, constitutes sufficient grounds for an injunction that could end a company's ability to operate in a market entirely. That argument has not yet been tested in court, and no ruling has been issued. For context on what proactive oversight can achieve, the Asia-Pacific region recorded a 23 percent decline in crypto fraud rates in 2025, a trend credited to improved enforcement frameworks. India's near-zero crypto ATM presence, a product of sustained regulatory uncertainty, illustrates the opposite dynamic: ambiguity constrains legitimate infrastructure as readily as it constrains bad actors. The question for regulators in Nairobi, Lagos, and Karachi is whether they wait for losses to scale before acting, or build consumer redress mechanisms into VASP licensing frameworks before crypto ATM networks reach the density that made Missouri a test case.