California orders CoinFlip to pay over $4.8 million to scam victims

The California Department of Financial Protection and Innovation (DFPI) ordered crypto ATM operator CoinFlip to pay more than $4.8 million to scam victims, according to the agency’s Wednesday, Nov. 4 order. The order also requires CoinFlip to pay California more than $350,000 over excessive fees and stop the practices regulators identified.

CoinFlip operates roughly 500 kiosks in the state, placing its customer checks, disclosures, receipts and transaction monitoring under scrutiny. The two payments are separate: more than $4.8 million for victims and more than $350,000 to California. The order summary does not specify how the victim payment will be distributed.

What did California find?

DFPI found that CoinFlip’s customer-screening and suspicious-activity controls had fallen short since 2021. The agency identified three areas of noncompliance:

• Transactions above California’s $1,000 daily limit per customer
• Missing disclosures before transactions
• Receipts without required information

Those safeguards sit at several points in a kiosk transaction, from checking a customer’s identity to explaining a purchase before payment. For CoinFlip, the operational response reaches beyond the two payments: the company must address those controls across roughly 500 machines. Scammers commonly instruct victims to withdraw cash and use a kiosk to send funds to a wallet they control. The machines cannot reverse crypto transfers, which limits the practical remedy after fraud occurs.

DFPI Commissioner KC Mohseni said: “protecting consumers is not optional.” In plain terms, California says CoinFlip did not consistently apply the basic checks expected at each step of a cash-to-crypto purchase.

How large is the FBI-reported loss problem?

The FBI received 13,460 complaints involving cryptocurrency kiosks in 2025, a 23% increase from 2024. Its adjusted losses reached $388,981,267, or nearly $389 million, up 58% from 2024. Some complaints involved other transaction types, so the full loss figure cannot be attributed to kiosk use alone. The data do not isolate CoinFlip, California kiosks or losses tied to fraudulent wallet withdrawals. In plain terms, complaint volume rose while aggregate losses increased more sharply, but the totals do not measure kiosk fraud alone.

How are state approaches diverging?

Hawaii’s cash-to-crypto ATM ban took effect Oct. 1, taking a stricter route than licensing conditions and monetary remedies. Separately, Washington regulators filed charges against CoinFlip in September, seeking to revoke its license, obtain consumer refunds and impose a $1,029,600 fine, about $1.03 million. CoinFlip can contest those charges, so the requested penalties are not final.

In October, Coinme agreed under a multistate settlement to end its kiosk operations by Jan. 1, 2027. That exit will remove Coinme from the kiosk market by the deadline. In plain terms, states are combining bans, license challenges and business exits to address crypto kiosks.

What happens next?

CoinFlip faces corrective obligations in California and unresolved regulatory proceedings in Washington, with separate exposure in each jurisdiction. The California order summary provides no compliance deadline, appeal deadline or detailed enforcement timetable, so none should be assumed. The Washington case remains open to contest because CoinFlip can challenge the charges. In plain terms, Coinme’s Jan. 1, 2027 exit is the clearest dated market change, while CoinFlip must still satisfy California’s corrective order and answer the Washington charges.