Design a Crypto ATM Network

Problem statement

Design a network of unattended kiosks that let a customer insert fiat cash and receive crypto into a wallet they control (buy), or send crypto from their wallet and collect fiat cash (sell). Each kiosk must display a live price including fees, lock that price for the duration of the cash insertion, enforce tiered identity checks, print or email a receipt, and survive hardware jams, network partitions, exchange outages, and blockchain reorgs without losing money or breaking the law.

The defining property of this system is that it operates in two liquidity worlds simultaneously. The physical world holds cash cassettes that fill up on buys and empty on sells, replenished by armored carriers on a 24-72 hour lead time. The digital world holds a hot wallet UTXO pool that empties on buys and fills on sells, rebalanced by on-chain sweeps and exchange withdrawals. A kiosk can be perfectly healthy and still be unable to serve a customer because the wrong side of the bridge is empty. Every serious design decision in this answer flows from that observation.

The second defining property is the regulatory perimeter. In the United States, FinCEN treats an operator that exchanges convertible virtual currency for fiat as a money transmitter and money services business; most states additionally require money transmitter licenses; thresholds such as the $10,000 currency transaction report trigger and the $3,000 travel-rule record threshold shape product limits. Compliance is therefore an architecture input, not a feature bolted on at the end.

Public baseline versus design assumptions

Public history anchors the category: the first bitcoin ATM went live in Vancouver on 29 October 2013 on a Robocoin kiosk. The public tracker Coin ATM Radar counted roughly 39,000 crypto ATMs worldwide at the 2022 peak, with consolidation afterwards. Bitcoin Depot, the largest US operator, reported 9,314 kiosks as of 31 December 2023 and about $596M of 2023 revenue in its SEC filings. These are cited public figures, not our requirements.

For capacity planning this answer explicitly assumes a mature operator with 12,000 kiosks across three countries, 60,000 transactions per day average, a 5x transaction peak during volatility events, an average buy ticket of $200 and sell ticket of $350, and a blended fee plus spread of 7 percent. Every uncited number in this answer is a stated assumption, budget, or target.

The four planes

1. Kiosk edge plane: unattended hardware, cash acceptor and dispenser drivers, tamper sensors, offline journal, local UI state machine.
2. Transaction core plane: quotes and price locks, transaction state machines, double-entry ledger, receipts, support vouchers.
3. Compliance and risk plane: tiered KYC orchestration, sanctions and chain screening, structuring detection, case management, SAR workflow, jurisdiction policy.
4. Treasury and liquidity plane: exposure netting and hedging, hot and cold wallet UTXO management, vault cash forecasting, armored carrier logistics, venue integrations.

A strong interview answer keeps these planes separate, states which one owns each failure, and never lets a latency optimization in one plane weaken correctness in another.