Security News > 2022 > August > Hackers Stole Crypto from Bitcoin ATMs by Exploiting Zero-Day Vulnerability
Bitcoin ATM manufacturer General Bytes confirmed that it was a victim of a cyberattack that exploited a previously unknown flaw in its software to plunder cryptocurrency from its users.
"This vulnerability has been present in CAS software since version 2020-12-08.".
CAS is short for Crypto Application Server, a self-hosted product from General Bytes that enables companies to manage Bitcoin ATM machines from a central location via a web browser on a desktop or a mobile device.
The zero-day flaw, which concerned a bug in the CAS admin interface, has been mitigated in two server patch releases, 20220531.
General Bytes said the unnamed threat actor identified running CAS services on ports 7777 or 443 by scanning the DigitalOcean cloud hosting IP address space, followed by abusing the flaw to add a new default admin user named "Gb" to the CAS. "The attacker modified the crypto settings of two-way machines with his wallet settings and the 'invalid payment address' setting," it said.
"Two-way ATMs started to forward coins to the attacker's wallet when customers sent coins to [the] ATM.".
News URL
https://thehackernews.com/2022/08/hackers-stole-crypto-from-bitcoin-atms.html
Related news
- Hackers Exploit Aviatrix Controller Vulnerability to Deploy Backdoors and Crypto Miners (source)
- Zero-Day Vulnerability in Ivanti VPN (source)
- Hackers Exploit Zero-Day in cnPilot Routers to Deploy AIRASHI DDoS Botnet (source)
- Hackers exploit 16 zero-days on first day of Pwn2Own Automotive 2025 (source)
- Hackers get $886,250 for 49 zero-days at Pwn2Own Automotive 2025 (source)
- Apple zero-day vulnerability exploited to target iPhone users (CVE-2025-24085) (source)
- Russian cybercrooks exploiting 7-Zip zero-day vulnerability (CVE-2025-0411) (source)
- XE Hacker Group Exploits VeraCore Zero-Day to Deploy Persistent Web Shells (source)
- zkLend loses $9.5M in crypto heist, asks hacker to return 90% (source)
- PostgreSQL Vulnerability Exploited Alongside BeyondTrust Zero-Day in Targeted Attacks (source)