General Bytes, a large cryptocurrency Automatic Teller Machine (ATM) manufacturer, disclosed on March 18, 2023, through Twitter that it suffered a “security incident” that resulted in the shutdown of various United States-based ATMs and the theft of approximately $1.5 million worth of bitcoin. General Bytes has approximately 15,000 ATMs located in over 149 countries around the globe, and a portion of the kiosks are “two-way”, meaning that customers can exchange cash-for-crypto as well as crypto-for-cash. Karel Kyovsky, the founder of General Bytes, detailed in a statement released on March 19 that the security incident occurred from March 17 to March 18 and that the actor responsible “was able to upload his own java application remotely via the master service interface used by terminals to upload videos and run it using batm user privileges.” This was made possible by exploiting a zero-day vulnerability tracked as BATM-4780. Kyovsky also detailed that the actor “scanned the Digital Ocean cloud hosting IP address space and identified running CAS services on ports 7741, including the General Bytes Cloud service and other GB ATM operators running their servers on Digital Ocean.” After gaining initial access, the actors were able to access the database, read and decrypt API keys used to access funds in exchanges and hot wallets, send funds from hot wallets, exfiltrate usernames and password hashes, disable two-factor authentication, and access terminal event logs to scan for instances where customers scanned private keys at the ATMs. Technical mitigation details as well as indicators of compromise (IOCs) can be viewed in General Bytes’ statement linked below.