Hacker hacked the servers of General Bytes bitcoin ATMs
The attack compromised user passwords and API keys
20.03.2023 - 08:00
718
2 min
0
What’s new? General Bytes, a bitcoin ATM manufacturer, reported the highest-risk incident, which occurred on March 17 and 18. By remotely uploading his own java application through the master service interface, the attacker managed to gain access to terminals and hack into GENERAL BYTES Cloud service as well as offline servers of other operators.
General Bytes’ official announcement
How did the attack happen? The attacker identified a vulnerability in the interface of the service used by crypto ATMs to upload videos to the server. The attacker scanned the Digital Ocean cloud hosting IP addresses and found running CAS services on ports 7741. Using this vulnerability, the hacker uploaded his own application directly to the server used by the admin interface. The application server was configured by default to run applications in the deployment folder. As a result of the hack, the hacker gained the following capabilities:
- Database access;
- Reading and decrypting API keys used to access funds in hot wallets and exchanges;
- Sending funds from hot wallets;
- Downloading usernames and password hashes;
- Disabling two-factor authentication;
- Accessing terminal event logs, including when customers scanned a private key with a crypto ATM.
To protect against the threats, General Bytes announced it was shutting down the cloud service and warned operators to install their own standalone server. In addition, due to the compromise of all users’ passwords, as well as API keys to exchanges and hot wallets, operators need to revoke them and generate new keys and passwords.
Last August, General Bytes also reportedthe compromise of its servers. Then hackers managed to change the system settings so that cryptocurrency came directly to their wallets. And in October, the FBI notedan increase in the use of cryptocurrencies by scammers. Individual losses of investors ranged from tens of thousands to millions of dollars.
Useful material?
Telegram 
Twitter Incidents
In a single week, hackers went after PHP websites, the Railway cloud platform and a medical company, and experts started talking about a crisis that is only just beginning.
Oct 28, 2026
Incidents
In 104 minutes, the attacker emptied 1,404 addresses before validators halted the network and froze almost all of the loot.
Oct 19, 2026
Incidents
Developers warned of potential risks to bridges across the ecosystem and asked exchanges for assistance.
Jun 22, 2026
Incidents
The defendant helped move funds stolen through investment scams and earned at least $4 million for his role in the operation.
Jun 10, 2026
Incidents
The company is linking the incident to a compromised private key on a service wallet, rather than a smart contract exploit
May 22, 2026
Incidents
Following the incident, the project temporarily halted trading operations and node activity.
May 15, 2026
Cryptocurrency rates
-
Bitcoin
$74 150
BTC
-0.59%
-
Ethereum
$2 090.64
ETH
-1.43%
-
BNB Smart Chain
$687.61
BSC
+0.34%
-
Ripple
$1.42
XRP
+1.04%
-
TRON
$0.319422
TRX
+0.51%
-
Zcash
$1 143.55
ZEC
-5.89%
-
Dogecoin
$0.069248
DOGE
+0.23%
-
Cardano
$0.218269
ADA
+2.11%
-
Stellar XLM
$0.184461
XLM
+2.83%
-
Polkadot
$3.32
DOT
+5.27%