Bitcoin ATM maker Lamassu Industries has successfully addressed a vulnerability that could have granted hackers “full control” over its Bitcoin ATM machines.
The flaw came to light when a team of ethical hackers from security firm IOActive attempted to compromise Lamassu’s Bitcoin ATMs in 2023.
During the process, which the team has documented online, the researchers identified and exploited several vulnerabilities that allowed them to gain full control over the ATMs.
In comments shared with Cointelegraph, Gunter Ollman, CTO of IOActive, explained that through the exploit, attackers could “view and manipulate interactions with the hijacked ATM.”
This meant that hackers had the potential opportunity to steal Bitcoin from users’ wallets by taking advantage of the identified vulnerabilities.
According to Ollman, a sophisticated attacker could modify the entire user experience, tricking users into performing actions such as entering bank account details.
Ollman assured the community that the attack’s impact would be limited to a user’s account balance, but the potential for social engineering was significant.
Gabriel Gonzalez, Director of Hardware Security at IOActive, commented that the vulnerability could grant an attacker “full control” over a physical ATM machine.
This included the ability to drain all the money in the ATM and manipulate the note reader to display inaccurate deposit amounts, he said.
The security researchers noted the severity of the vulnerabilities, especially if the ATMs were left unattended in various locations.
Lamassu Industries responded promptly to the findings, deploying a security patch to fix the vulnerabilities before they were publicly disclosed in 2024, and told owners of their Bitcoin ATMs to update their software.
As reported earlier this month, the number of installed Bitcoin ATMs worldwide fell in 2023 after having risen every year for more than a decade.
According to data from Coin ATM Radar, the fall was attributed to a notably lower number of machines in the US from 2022 to 2023, while several other regions of the world saw an increasing number of machines.
The US accounts for 82% of all installed Bitcoin ATMs globally, with 27,621 installed machines as of the end of last year, per Coin ATM Radar’s data.
You must be logged in to post a comment.