One of the biggest threats to cryptocurrency is the emergence of Bitcoin ATMs.

• The FTC warns that bitcoin ATM fraud is soaring.
• In 2023, losses from scams at crypto ATMs in the U.S. surpassed $120 million.
• 74% of cryptocurrency ATMs globally are managed by just 10 operators.

Bitcoin ATMs are becoming increasingly common in the US and, according to some experts, are also becoming a major threat to cybersecurity. These ATMs function similarly to traditional ones, requiring a PIN and charging withdrawal fees.

Bitcoin ATMs are more likely to be targeted by hackers compared to cash ATMs.

According to Timothy Bates, clinical professor of cybersecurity at the University of Michigan's College of Innovation and Technology, these machines are highly susceptible to both physical and cyber threats, making them a top priority for hackers and thieves.

Bitcoin ATMs are vulnerable to attacks where hackers can install malware to capture private keys, steal funds, or manipulate transactions. This is especially concerning for ATMs that do not receive regular software updates or security patches. Additionally, network vulnerabilities can be exploited by attackers to intercept data transfers between the ATM and the server, leading to data theft or unauthorized access.

Scammers are the target of government warnings about bitcoin ATMs, with the Federal Trade Commission reporting a 1,000% increase in scam incidents since 2020.

Bitcoin's decentralized, permission-less, and immutable nature makes it a popular choice for many investors, but it also poses risks for Bitcoin ATMs, according to Joe Dobson, principal analyst at Mandiant, a Cloud-owned cybersecurity company. While many crypto bulls appreciate Bitcoin's lack of governance, this can be problematic in ATMs, as there is no governing body within Bitcoin dictating who can or cannot run a Bitcoin ATM, and many independent organizations operate the ATMs. As a result, transactions deposited to the wrong address cannot be reversed or recalled, making it important for users to exercise caution when using Bitcoin ATMs.

In traditional banking, there are old criminal tricks that can be reversed, but in the world of bitcoin, this is not possible. For instance, someone could intentionally insert their personal deposit slips into the stack at the bank, leading others to deposit money into their account. Similarly, an attacker who compromises a bitcoin ATM can change the receiving wallet address, effectively stealing user funds.

Bitcoin ATMs pose new threats to cash ATMs, as they require personally identifiable information such as an ID or Social Security number to comply with KYC regulations. This information could be at risk if a bitcoin ATM is compromised.

In Middletown, Ohio, at a convenience store located in a rundown area, an ATM stands next to a regular cash ATM, surrounded by snacks, drinks, and beer. Recently, the town has gained notoriety as the birthplace of Ohio Senator J.D. Vance, who has transformed himself into a fervent supporter of cryptocurrency, echoing the same stance as his running mate, Donald Trump. The convenience store is located near the spot where Vance grew up.

'Elon Musk told me to do it.'

Middletown Food Mart's owner, Sai Patel, states that the bitcoin ATM isn't particularly busy.

Patel stated that although the bitcoin ATM isn't popular, a surprising number of senior citizens visit the kiosk, which is concerning due to the increase in bitcoin ATM scams targeting seniors. He also mentioned that he patiently explains the machine's operation to new users and keeps an eye out for unusual activity.

"Elderly people come in and use it," Patel said.

An elderly woman visited Patel's shop and went to the bitcoin ATM to send a large sum of money, but she was unsure about using the machine. When Patel inquired about her actions, she stated that Elon Musk had instructed her to do so. Patel quickly recognized the scam and advised the woman against it, preventing her from losing her life savings.

Outset PR's head of security and compliance, Alice Frei, states that bitcoin ATM fraud is expensive and is exacerbated by the murky realm of cryptocurrency.

"Anonymity in online cryptocurrency exchanges allows criminals to move money undetected, using techniques such as cross-blockchain 'bridges' to further conceal transactions," she stated.

The difficulty in tracing and recovering stolen funds from crypto exchanges involved in ATM scams is due to the fact that many of these exchanges are based offshore, beyond the reach of regulators.

Basic steps to avoid bitcoin ATM scams

Legitimate businesses rarely demand payment in bitcoin through a machine, so users should be cautious and skeptical of any request to pay through a bitcoin ATM to avoid scams.

It is essential to verify the legitimacy of a transaction, especially by checking the recipient's wallet for links to suspicious entities, according to Frei. Additionally, using licensed ATMs from reputable operators can help minimize the risk.

Frei stated that users can take certain steps to confirm the authenticity and legality of a bitcoin ATM or the individuals involved in transactions.

To verify the recipient address, you can check for flagged activity on platforms like Chainabuse and run an AML check using available tools. If the risk score is above 70%, it's advisable to avoid sending money. Instead, contact the ATM operator or the person who provided the address to clarify the situation.

Nearly 74% of ATMs worldwide are controlled by 10 companies, according to Frei's data analysis.

Bitcoin Depot, the largest operator of bitcoin ATMs, has over 8,000 machines. Its CEO, Brandon Mintz, claims that the company's machines are designed to prevent hacking. However, he also disputes the notion that bitcoin ATMs are major targets for hacking.

Bitcoin ATMs are not typically targeted by cybercriminals because they have separate hardware and bitcoin wallet environments, according to Mintz. Bitcoin Depot does not store any bitcoin locally at its ATMs and has multiple layers of verification and approval processes to prevent unauthorized access to its wallet.

Bitcoin ATMs, such as Bitcoin Depot, only accept cash, which prevents criminals from using card skimmers. However, users must be cautious of scams and follow the same basic protocols to protect themselves from financial fraud in the world of cryptocurrency.

It is crucial for bitcoin ATM customers to avoid sending bitcoin or other cryptocurrencies to unfamiliar digital wallets or individuals they do not trust, as it is essential to remain cautious and skeptical of anyone requesting cryptocurrency payments, particularly if the request is urgent or threatening, according to Mintz.

Bitcoin Depot, as the market leader, has faced legal challenges and disclosed in its S-1 filing that its users could be at risk of cybersecurity incidents like account takeovers. A South Carolina woman sued the company after falling victim to a cryptocurrency scam, while authorities in Texas intervened to recover funds from a Bitcoin Depot ATM after a woman was scammed.

The key to combating fraud in cryptocurrency lies not in advanced technology, but in user responsibility, as there is little recourse if something goes wrong and the burden falls heavily on the individual to take action.