- Jul 27, 2015
- 5,458
Over the weekend, General Bytes revealed that more than $1.5 million worth of bitcoin had been drained from CASes operated by the company and by customers. To pull off the heist, an unknown threat actor exploited a previously unknown vulnerability that allowed it to use this interface to upload and execute a malicious Java application. The actor then drained various hot wallets of about 56 BTC, worth roughly $1.5 million. General Bytes patched the vulnerability 15 hours after learning of it, but due to the way cryptocurrencies work, the losses were unrecoverable.
Going forward, this weekend’s post said, General Bytes will no longer manage CASes on behalf of customers. That means terminal holders will have to manage the servers themselves. The company is also in the process of collecting data from customers to validate all losses related to the hack, performing an internal investigation, and cooperating with authorities in an attempt to identify the threat actor.
General Bytes said the company has received “multiple security audits since 2021,” and that none of them detected the vulnerability exploited. The company is now in the process of seeking further help in securing its BATMs.
Hackers drain bitcoin ATMs of $1.5 million by exploiting 0-day bug
Don't store digital coins in hot wallets! It's great advice but can't always be followed.
arstechnica.com