A Bitcoin ATM was stolen from a Grayscale Bitcoin Trust crypto exchange in Barcelona on Friday, Nov. 12.

Police in Catalonia are investigating the theft of a bitcoin ATM in a wealthy Barcelona neighborhood on Friday, Nov. 12, 2021, at around 3 AM. The ATM was located in a brick-and-mortar crypto exchange outlet belonging to Grayscale Bitcoin Trust in the Sarria neighborhood. A video claimed to be depicting the robbery showed an SUV colliding with closed shutters of the exchange’s storefront, followed by six men who carried the machine into another car that was nearby. Police declined to comment on the investigation to the local media.

Crypto ATM crimes are getting more nefarious

Bitcoin ATMs offer users the ability to buy cryptocurrency or with the cash value of cryptocurrencies. Bitcoin ATM deployments are growing. There are 158 Bitcoin ATMs in Spain. There are 26,000 bitcoin ATMs in the U.S. alone, compared with 4,212 in Jan. 2022. Walmart and Circle K  have been installing ATMs recently. Bitcoin ATMs are also becoming common in gas stations and convenience stores in the U.S. Generally, these ATMs provide an easy user experience but can be easy for criminals to target. 

CNBC recently reported that ATMs are being exploited in the U.S. for drug trafficking, money laundering, and a variety of fraud, and many operators of bitcoin ATMs are not registered with the U.S. Treasury Department’s Financial Crimes Enforcement Network in states where the regulations are lax. 

Purchases of up to $900 worth of cryptocurrency allow users to supply only a cellphone number while some require no identification, allowing drug traffickers, money launderers, and people to lure victims into depositing money into their crypto accounts.

Coinflip, a Chicago-based crypto operator, reported that users of their ATMs must provide a name and cellphone number, while higher amounts require additional identification. The company uses blockchain analytics tools to detect fraudulent activity.

In more conventional ATM crime stories, charges were laid against a 24-year-old man in Surrey in July 2021, related to bitcoin ATM robberies and property crimes. The alleged bitcoin robberies took place on June 11, 2021, in Langley.  In Atlanta, Georgia, a gas station was robbed on Oct.14, 2021, and amongst the commotion, a bitcoin ATM belonging to ChainBytes had its screen shattered through a stray bullet.

Kraken Security Labs find some ATMs as easily exploitable

Kraken Security Labs has discovered both hardware and software vulnerabilities in the General Bytes BATMtwo (GBBATM2). The ATMs, which operate on Google’s Android operating system, include a default admin QR code, which allows anyone with this QR code to compromise an ATM. There is also a lack of features in the secure boot procedures and severe gaps in the ATM management. It is possible to boot the device by holding down a button while the computer powers up and load a new application. 

There is also a hardware key that opens the ATM cash box, which permits access to the ATMs computer, which one can connect a keyboard or mouse to access the Android operating system. There is no tamper detection on the ATM that gets logged to the server. Kraken Security Labs offers precautions to owners or operators of Bitcoin ATMs to change the admin QR code from the default, update the Crypto Application Server (CAS)and follow General Bytes’ best practices, and place the ATMs in locations with surveillance security.

What do you think about this subject? Write to us and tell us!