Bitcoin ATMs (BATMs) hit with zero-day exploit, people lose $1.5mil in cryptocurrency

[thewayne]

First off, terms: A Zero-Day is an exploitable flaw or flaws that the software makers don't know about, and therefore, it hasn't been fixed. Sometimes it takes multiple zero-days being chained together to truly exploit a system.

Bitcoin Wallet: a wallet is where you store the crypto keys that identify you as holding bitcoins. There are two types, Hot and Cold. A Cold Wallet is not available on the internet and is fairly safe. But a BATM needs a Hot Wallet to access your funds, which is connected to the internet.

What happened here was that the BATMs were vulnerable to exploits, and were hit. The exploits let the attackers get to the administrative interface, which gave them access to logs that included crypto keys, which gave them access to people's hot wallets which were then hit.

As the article says: "The incident underscores the risk of storing cryptocurrencies in Internet-accessible wallets, commonly called hot wallets. Over the years, hot wallets have been illegally drained of untold amounts of digital coin by attackers who exploit various vulnerabilities in cryptocurrency infrastructures or by tricking wallet holders into providing the encryption keys required to make withdrawals.

Security practitioners have long advised people to store funds in cold wallets, meaning they’re not directly accessible to the Internet. Unfortunately, BATMs and other types of cryptocurrency ATMs generally can’t follow this best practice because the terminals must be connected to hot wallets so that they can make transactions in real time. That means BATMs are likely to remain a prime target for hackers."

https://arstechnica.com/information-technology/2023/03/hackers-drain-bitcoin-atms-of-1-5-million-by-exploiting-0-day-bug/

Comments

[rain_gryphon]

I'm cool. I cashed in all of my cryptocurrency some time back, when I just lost faith in the entire concept. It technically isn't a Ponzi Scheme, but it's close, with all of the value riding on sustained demand. Even the most overvalued industrial stock will have some sort of baseline intrinsic value that allows you to form an idea about risk. 'Coins' just don't.

[disneydream06]

I am so happy sticking with my real money. :o
Hugs, Jon

[thewayne]

Good for you, getting out.  I agree, it isn't a Ponzi scheme per se.  But there is nothing to back its value except for speculation driving up the price.  A couple of coins try to link to real U.S. dollars, but I don't think they're very successful.

[thewayne]

In a bank, it's pretty darn safe.

[silveradept]

I feel like there are safer and better-regulated unregulated markets to park speculative funds in than cryptocurrency, and they'll produce potentially equally as good as returns on investment at this point. With less vulnerability to hacking.