Bitcoin ATM manufacturer General Bytes has shuttered its cloud services after discovering a “security vulnerability” that allowed an attacker to access users' hot wallets and gain sensitive information, such as passwords and private keys.
The company is based in Prague and according to its website has sold over 15,000 Bitcoin (BTC) ATMs to purchasers in over 149 countries all over the world.
In a March 18 patch release bulletin, the ATM manufacturer issued a warning explaining that a hacker has been able to remotely upload and run a Java application via the master service interface into its terminals aimed at stealing user information and sending funds from hot wallets.
On March 17-18th, 2023, GENERAL BYTES experienced a security incident.
— GENERAL BYTES (@generalbytes) March 18, 2023
We released a statement urging customers to take immediate action to protect their personal information.
We urge all our customers to take immediate action to protect their funds and https://t.co/fajc61lcwR…
General Byes founder Karel Kyovsky in the bulletin explained this allowed the hacker to achieve the following:
- “Ability to access the database.
- Ability to read and decrypt API keys used to access funds in hot wallets and exchanges.
- Send funds from hot wallets.
- Download user names, their password hashes and turn off 2FA.
- Ability to access terminal event logs and scan for any instance where customers scanned private key at the ATM. Older versions of ATM software were logging this information.”
The notice reveals that both General Bytes’ cloud service was breached as well as other operators’ standalone servers.
“We’ve concluded multiple security audits since 2021, and none of them identified this vulnerability,” Kyovsky said.
Hot wallets compromised
Though the company noted that the hacker was able to “Send funds from hot wallets,” it did not disclose how much was stolen as a result of the breach.
However, General Bytes released the details of 41 wallet addresses that were used in the attack. On-chain data shows multiple transactions into one of the wallets, resulting in a total balance of 56 BTC, worth over $1.54 million at current prices.
Another wallet shows multiple Ether (ETH) transactions, with the total received amounting to 21.82 ETH, worth roughly $36,000 at current prices.
Cointelegraph reached out to General Bytes for comment and the company replied with a statement confirming the hack “resulted in the loss of funds” for some of their customers who used their cloud-hosted services.
“We have taken immediate steps to prevent further unauthorized access to our systems and are working tirelessly to protect our customers," General Bytes said.
"We are refunding our cloud-hosted customers who have lost funds."
According to the statement, the hack did not affect most ATM operators using self-hosted server installations because they use VPN technology to protect their infrastructure.
"We sincerely apologize for any inconvenience or harm caused and are taking swift action to address the situation,” General Bytes said.
Related: Bitcoin ATM decline: Over 400 machines went off the grid in under 60 days
The company has urgently advised BTC ATM operators to install their own standalone server and released two patches for their Crypto Application Server (CAS), which manages the ATM's operation.
“Please keep your CAS behind a firewall and VPN. Terminals should also connect to CAS via VPN,” Kyovsky wrote.
“Additionally consider all your user’s passwords, and API keys to exchanges and hot wallets to be compromised. Please invalidate them and generate new keys & password.”
General Bytes previously had its servers compromised via a zero-day attack last September that enabled hackers to make themselves the default administrators and modify settings so that all funds would be transferred.
Updated March 28 with comments from General Bytes.