Exploitation of Zero-Day Bug Results in Bitcoin ATM Drainage by Hackers


(Image credit: Shutterstock / Wit Olszewksi)

Hackers Steal $1.5 Million from Cryptocurrency ATMs

Unknown hackers have managed to steal 56 bitcoin, worth approximately $1.5 million, from specialized ATMs designed to distribute cryptocurrency. The worst part is that the stolen funds partially belonged to the ATM’s customers as well.

According to the report, the ATMs work by allowing customers to connect it to a crypto application service (CAS) either they or the company manages. However, the ATM also allowed customers to upload videos from the terminal to the CAS – which is apparently where the bug was hiding.

A previously unknown, zero-day vulnerability allowed the threat actors to upload and run a malicious Java application and use it to drain the CASes operated by both the company and its customers.

Keeping Customers Afloat

General Bytes, the company behind the ATMs, addressed the issue 15 hours after being alerted to the flaw. However, the only way to get the funds back is to have the police find and arrest the perpetrators, then confiscate and return the stolen cryptocurrency – which is obviously easier said than done.

“The night of 17-18 March was the most challenging time for us and some of our clients. The entire team has been working around the clock to collect all data regarding the security breach and is continuously working to resolve all cases to help clients back online and continue to operate their ATMs as soon as possible,” the company wrote in an announcement.

“We apologize for what happened and will review all our security procedures and are currently doing everything we can to keep our affected customers afloat.”

By uploading and running the malware, the attacker gained access to the ATM’s database, was allowed to read and decrypt encoded API keys needed to access the funds, and finally managed to withdraw the crypto to a separate wallet. Furthermore, the attackers managed to download usernames and password hashes, turn off multi-factor authentication (MFA), and access terminal event logs to scan for customer private keys.


It is important to note that cryptocurrency theft is becoming more common, and it is essential to take all necessary precautions to protect your assets. General Bytes is changing its procedures to ensure that customers manage their CASes themselves, and it is crucial to stay vigilant and informed about the latest security threats.

  • Here’s our list of the best ID theft protection right now

Via: Ars Technica

Sign up to the FLD Magazine newsletter to get all the top news, opinion, features, and guidance your business needs to succeed!

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Leave A Reply

Your email address will not be published. Required fields are marked *

Related Posts