Iowa’s Supreme Court upheld a Bitcoin ATM operator’s right to recover $11,500 seized by police. The cash had already been paid to the scam victim under a separate order, leaving the lower court to resolve the remaining claims.
The Iowa Supreme Court ruled that a 2025 law requiring cryptocurrency ATM operators to refund fraud victims cannot apply to a 2024 transaction. In its October 30 opinion, the court held that Bitcoin Depot was entitled to recover $11,500 seized from its ATM. It overturned the lower court’s refusal to return the cash and sent the case back for further proceedings.
Police recovered the banknotes left in the machine, not the bitcoin received by the fraudsters. The cash was paid to the victim in a separate proceeding while the appeal was pending. The Supreme Court did not order the victim to repay it immediately or direct the state to make an immediate payment to the operator.
Who owned the $11,500?
According to the opinion, Gary VanderWerf deposited $11,500 at a Bitcoin Depot ATM in a Cedar Falls convenience store on August 12, 2024, after communicating with three unidentified people. The operator sent bitcoin of matching value from its inventory to the wallet he specified. VanderWerf confirmed that he controlled the receiving wallet, but it belonged to the fraudsters.
By accepting the transaction terms, the customer acknowledged that the deposited cash would belong to Bitcoin Depot. The operator also displayed warnings that transactions were irreversible and that customers must not send bitcoin to a wallet they did not control. The court found that the customer had exchanged his cash for bitcoin. Even though the bitcoin was lost, he no longer owned the banknotes in the ATM.
VanderWerf reported the scam to police after realizing he had been deceived. Officers executed a search warrant on August 15 and seized $11,500 from the machine. Bitcoin Depot assisted the investigation, but the bitcoin was not recovered and the investigation closed without charges. On July 18, 2025, the operator applied for the return of cash no longer needed as evidence.
The district court refused to return the cash because the new refund rule was in force when the operator applied. The Supreme Court said the relevant event was the 2024 transaction, rather than the later application. For the 2025 refund duty to cover earlier transactions, lawmakers would have had to say so explicitly. They did not do so in section 533C.1004.
Three other justices joined the majority opinion written by Justice Thomas Waterman. Justice Dana Oxley and two colleagues agreed that the ruling should be reversed, but offered a different rationale: a customer’s refund claim against an operator does not give the customer ownership of particular seized banknotes. In their view, the cash could be returned to the operator without deciding whether the statute applied retroactively.
The victim has already received the cash
On December 18, 2025, another judge granted VanderWerf’s separate request for the $11,500. The state paid the money, but neither Bitcoin Depot nor its lawyers had been notified of that hearing. The Supreme Court learned of the separate order on September 8, 2026, two days before oral argument.
The court said the operator could challenge the December order on remand and might seek the value of the seized cash from the state. The lower court must first decide how the operator can recover the money. The Supreme Court has not determined who must pay or when.
Another company took over the operator’s claim during the appeal. According to the opinion, Bitcoin Depot Operating, LLC filed for Chapter 11 bankruptcy protection, and its claim to the seized cash became an asset of the bankruptcy estate. GDP Holdings, doing business as Coinflip, bought assets that included the right to seek the seized cash and replaced the operator in the appeal.
The court’s case page for appeal 25-1639 provides the September 10, 2026 hearing details and the oral argument recording on the Iowa Courts channel. The parties presented their appellate arguments at that hearing; the court issued its written decision on October 30.
What are the refund requirements?
The court did not strike down Iowa’s crypto ATM law. It held that the provision applying to operators from July 1, 2025, could not create a new refund obligation for the earlier transaction. Under section 533C.1004, customers have different reporting deadlines depending on when they first used the same operator.
| Customer | Coverage and reporting deadline |
|---|---|
| New customer | Transactions during the first 30 calendar days after first using that operator. The customer must report the fraud within 90 calendar days of the last transaction in that period. |
| Existing customer | The customer must report the fraud within 90 calendar days of the transaction they want refunded. |
For either group, the transaction must have resulted from fraud. The customer must report it to both the operator and a government or law enforcement agency, and provide the operator with evidence. Examples include a police report or a sworn declaration detailing the fraud. When the conditions are met, the operator must refund the full transaction amount. Because the majority declined to apply the law to the 2024 transaction, those justices did not separately decide whether VanderWerf met the reporting and proof requirements.
The law also caps the amount an operator accepts from or pays to a customer at $1,000 per calendar day, with a $10,000 total for a new customer’s first 30 days. The majority reasoned that operators could not enforce daily and monthly limits on transactions already completed, supporting its conclusion that the law applied only going forward. It did not set the $1,000 daily limit as a damages cap for the victim in this case.
Governor Kim Reynolds approved SF2296 on May 6, 2026, changing provisions on operator licensing, definitions and enforcement. It did not amend subsections 8 and 9 governing refunds for new and existing customers. The May legislation made violations of the ATM statute unlawful practices under the state’s consumer protection law.
Operators must provide receipts containing the date and time, amount, transaction ID, relevant wallet addresses and their contact details. Before a transaction, they must warn customers about fake bank or police contacts, claims that an account is frozen and fraudulent payment demands. Operators, or specialist providers acting for them, must use blockchain analytics software to help prevent transfers to wallets known to be linked to fraud and identify suspicious transactions.
Iowa’s judicial branch announced on its official account on October 30 that the Supreme Court had issued an opinion in one case that week. The post below links to the court’s opinions list.
Iowa judicial branch announcement of October 30, 2026 opinions
The post loads from X when you open it.
