Bitcoin ATM maker shuts cloud service after user hot wallets compromised

Bitcoin ATM shaper General Bytes has shuttered its unreality services aft discovering a “security vulnerability” that allowed an attacker to entree users' blistery wallets and summation delicate information, specified arsenic passwords and backstage keys.

The institution is simply a Bitcoin (BTC) ATM shaper based successful Prague, and according to its website, has sold implicit 15,000 ATMs to implicit 149 countries each implicit the world.

In a March 18 spot merchandise bulletin, the ATM shaper issued a informing explaining that a hacker has been capable to remotely upload and tally a Java exertion via the maestro work interface into its terminals aimed astatine stealing idiosyncratic accusation and sending funds from blistery wallets.

General Byes laminitis Karel Kyovsky successful the  bulletin explained this allowed the hacker to execute the following:

• "Ability to entree the database.
• Ability to work and decrypt API keys utilized to entree funds successful blistery wallets and exchanges.
• Send funds from blistery wallets.
• Download idiosyncratic names, their password hashes and crook disconnected 2FA.
• Ability to entree terminal lawsuit logs and scan for immoderate lawsuit wherever customers scanned backstage cardinal astatine the ATM. Older versions of ATM bundle were logging this information."

The announcement reveals that some General Bytes' unreality work was breached arsenic good arsenic different operators' standalone severs. 

“We’ve concluded aggregate information audits since 2021, and nary of them identified this vulnerability,” Kyovsky said.

Hot wallets compromised

Though the institution noted that the hacker was capable to “Send funds from blistery wallets,” it did not disclose however overmuch was stolen arsenic a effect of the breach.

However, General Bytes released the details of 41 wallet addresses that were utilized successful the attack. On-chain information shows aggregate transactions into 1 of the wallets, resulting successful a full equilibrium of 56 BTC, worthy implicit $1.54 cardinal astatine existent prices.

General Bytes released the details of 41 wallet addresses utilized successful the attack. Source: General Bytes

Another wallet shows aggregate Ether (ETH) transactions, with the full received amounting to 21.82 ETH, worthy astir $36,000 astatine existent prices.

Cointelegraph reached retired to General Bytes for confirmation but did not person a reply earlier publication.

Related: Bitcoin ATM decline: Over 400 machines went disconnected the grid successful nether 60 days

The institution has urgently advised BTC ATM operators to instal their ain standalone server and released 2 patches for their Crypto Application Server (CAS), which manages the ATM's operation.

General Bytes is Bitcoin ATM shaper based successful Prague that has sold implicit 15,000 ATMs worldwide. Source: General Bytes

"Please support your CAS down a firewall and VPN. Terminals should besides link to CAS via VPN," Kyovsky wrote.

"Additionally see each your user's passwords, and API keys to exchanges and blistery wallets to beryllium compromised. Please invalidate them and make caller keys & password."

General Bytes antecedently had its servers compromised via a zero-day attack successful September past twelvemonth that enabled hackers to marque themselves the default administrators and modify settings truthful that each funds would beryllium transferred.