Bitcoin ATMs: A Growing Cybercrime Menace

Bitcoin ATMs are a rapidly growing presence in the United States and, some experts say, a rapidly growing cybercrime menace. ATMs dealing in bitcoin are similar to their cash cousins: there are PINs to punch and withdrawal fees, just like any other ATM.

Bitcoin ATMs are rapidly becoming a common sight in the United States, but some experts say they also pose a growing cybercrime threat.

ATMs that deal in bitcoin are similar to their cash counterparts: they have PINs and withdrawal fees. But unlike cash ATMs, the high value of crypto makes them a prime target for hackers. A cash ATM tucked away between the snack cakes and energy drinks at a gas station may not draw much attention, but a bitcoin ATM gets more scrutiny from bad actors.

"It's clear that these machines are particularly vulnerable to both physical and cyber threats, making them a prime target for hackers and thieves," said Timothy Bates, clinical professor of cybersecurity at the University of Michigan's College of Innovation and Technology.

Bitcoin ATMs can be susceptible to attacks where hackers install malware on the machines to capture private keys, steal funds, or manipulate transactions, which Bates said is "especially concerning for ATMs that may not receive regular software updates or security patches." Network vulnerabilities are also a weak spot. "If the machine's network communications are not adequately secured, attackers can intercept data transfers between the ATM and the server, leading to data theft or unauthorized access," Bates said.

Whether it's hackers or scammers, the government is sounding the alarm about bitcoin ATMs. The Federal Trade Commission reported this week that scam incidents have risen by 1,000% since 2020.

Ironically, a bitcoin ATM's risks are directly related to its strengths, according to Joe Dobson, principal analyst at Mandiant, a Google Cloud-owned cybersecurity company. Bitcoin is decentralized, permission-less, and immutable. "A transaction cannot be reversed or recalled if funds are deposited to the wrong address," Dobson said. And while many crypto bulls find bitcoin's lack of governance appealing, that can be problematic in ATMs. "There is no governing body within bitcoin dictating who can or cannot run a bitcoin ATM, hence many independent organizations operate the ATMs," Dobson said.

There are also old criminal tricks that might be reversible in a traditional banking situation, but in the world of bitcoin, that is not so. For example, someone could maliciously slip their personal deposit slips into the stack at the bank, tricking folks into depositing money into their account. "A similar attack can happen with bitcoin ATMs," Dobson said. "If an attacker compromises a bitcoin ATM, they may change the receiving wallet address (or 'account number'), effectively stealing user funds."

But in addition to old tricks, there are newer threats bitcoin ATMs introduce that cash ATMs do not face. Many bitcoin ATMs require personally identifiable information, such as an ID or even a Social Security number to comply with financial industry Know Your Customer (KYC) requirements. This information could be at risk if a bitcoin ATM is compromised.

In Middletown, Ohio, at the Middletown Food Mart in a hollowed-out end of town, a Bitcoin Depot ATM sits opposite a regular cash ATM, blending in among the potato chips, bottled water, and beer. Middletown's claim to fame lately is as the hometown of Donald Trump's running mate Ohio Senator J.D. Vance, who has refashioned himself, similar to Trump, as a pro-cryptocurrency warrior. The Middletown Food Mart sits across the street from where Vance grew up.

'Elon Musk told me to do it.'

Sai Patel, whose family owns Middletown Food Mart, says the bitcoin ATM isn't very busy.

"Maybe once a month someone comes in to use it," Patel said. And if it is someone new, Patel will patiently explain how the machine works. He also keeps an eye out for unusual activity. Although the bitcoin ATM isn't exactly drawing crowds, Patel says a surprising number of senior citizens show up at the kiosk, alarming given the rise of bitcoin ATM scams targeting seniors.

"Elderly people come in and use it," Patel said.

He described one encounter where an elderly woman entered his shop and headed for the bitcoin ATM, then attempted to send a lot of money somewhere but had questions about using the machine. When Patel asked the woman a few questions as to why, she said, "Elon Musk told me to do it." Patel quickly realized she had fallen prey to a scam. "I told her, no, no, no, it's a scam," Patel said, and he stopped her from dumping her life savings into the machine.

Alice Frei, head of security and compliance at blockchain communications & consulting agency Outset PR, says bitcoin ATM fraud is costly, enhanced by the sometimes shadowy world of crypto.

"Cryptocurrencies are easily exchanged online, often without clear identification of the parties involved. Criminals exploit this anonymity and move money almost invisibly, often employing techniques such as cross-blockchain 'bridges' to further obscure transactions," she said. And then there's the fact that an ATM scam probably doesn't originate in the town where it occurs. "Many crypto exchanges involved in these activities are based offshore, beyond the reach of regulators