[2019-03-12] Bitcoin ATM Double-Spenders: Police Need Help Identifying Criminals

[gentlemand]

https://www.ccn.com/bitcoin-atm-double-spenders-police-need-help-identifying-four-criminals

This is an interesting one and one of the first times I've heard about this. I guess many Bitcoiners are too fluffy and idealistic to do this but it's an opportunity that's been left on the table so someone's going to pick it up.

[1715336024]

1715336024

[NeuroticFish]

Arguably, Canadian Bitcoin Core developer Peter Todd’s replace-by-fee tools would make these transactions possible.

I don't know that "special", but really? Modern wallets, including Electrum, allow creation of RBF tx. All what was needed really was to know that 0-confirmation transactions are considered good by the ATM.

CCN was unable to get any of these companies on the phone. We wanted to inquire whether they allow for 0-confirmation transactions or not.

I laughed at this one. Why on earth would the companies tell that (assuming they would have answered the phone)?
The article is already an invitation (for many!) to check whether this vulnerability was fixed in the Bitcoin ATMs they know. They wanted to make it even more obvious?

[nutildah]

Arguably, Canadian Bitcoin Core developer Peter Todd’s replace-by-fee tools would make these transactions possible.

I don't know that "special", but really? Modern wallets, including Electrum, allow creation of RBF tx. All what was needed really was to know that 0-confirmation transactions are considered good by the ATM.

Yep, really dumb to accept a zero confirmation tx at a BTC ATM. Or for any purpose, really, unless you absolutely trust the sender. Is that really even a crime? I guess taking the money without paying the BTC is, but I wonder what they are actually going to be charged with (if caught).

[gentlemand]

Yep, really dumb to accept a zero confirmation tx at a BTC ATM. Or for any purpose, really, unless you absolutely trust the sender. Is that really even a crime? I guess taking the money without paying the BTC is, but I wonder what they are actually going to be charged with (if caught).

I presume it's would be the same as paying for something in a shop and then taking your money back out of the till. It is of course the owner's fault for leaving it wide open but you're still obtaining something dishonestly.

[Theb]

CCN was unable to get any of these companies on the phone. We wanted to inquire whether they allow for 0-confirmation transactions or not.

I laughed at this one. Why on earth would the companies tell that (assuming they would have answered the phone)?
The article is already an invitation (for many!) to check whether this vulnerability was fixed in the Bitcoin ATMs they know. They wanted to make it even more obvious?

If the scam is happening right now and the authorities are the one to notice then I don't think CCN doesn't need anyone to confirm anything at this point, this is just a classic move done by these crypto news site showing that they act like real journalist, I don't even think that they really did try to reach them. The point is with a lot of crypto scammers existing right now they will always try to take advantage the flaw they see in the system and try to take money from it. Now the 0 confirmation to achieve the convenience their customers are looking for will be seen as a flaw and for sure crypto atm companies will try to remove it within their system.

[o_e_l_e_o]

This is kind of their own fault, no? If they are going to accept zero confirmation transactions, the very least they could do was refuse to accept ones which are opted in to RBF. While doing so by no means makes zero confirmation transactions safe, it at least prevents an attack as simple to pull off as this one.

In all likelihood though, bitcoin ATMs will likely have to stop accepting zero confirmation transactions. Perhaps a system where you can get an address to send to online, and it gives you a QR code on your phone which you can then scan at an ATM of your choosing and it will spit out the cash?

[1Referee]

Is that really even a crime? I guess taking the money without paying the BTC is, but I wonder what they are actually going to be charged with (if caught).

Of course it is a crime. It doesn't matter how it happens, and how stupid the ATM operator is, they purposely took someone's money.

It's quite sad that these things are happening, but they're a welcome wake-up call, because this will stimulate other operators of ATM's to at least wait for that confirmation. It legit surprises me how stupid this whole zero-fee ATM setup is in the crypto world with how it's quite easy for con artists to figure out how to game the system.

BitPay for example only allows $25 worth of payments to be accepted instantly, which is tolerable. The fact that they still offer that option means that there is little to no abuse worth taking it down for.

[stompix]

Wait, so you go to an ATM, knowing you're going to do something that is punishable by law and you let the damn obvious camera (I've used an ATM like that and you can spot the camera a mile away) take a perfect mug shot of you laughing?

Seriously they are smart enough to do that (which probably half of the forum isn't capable of) and they didn't think of wearing some damn sunglasses as the fourth guy did?

https://www.ccn.com/bitcoin-atm-double-spenders-police-need-help-identifying-four-criminals

This is an interesting one and one of the first times I've heard about this. I guess many Bitcoiners are too fluffy and idealistic to do this but it's an opportunity that's been left on the table so someone's going to pick it up.

For guys in the US and Canada ...

Not all ATM operators are like that, besides the obvious zero confirmation rule, some even require a perfect mugshot and ID card picture and since one of the ATMs I know is exactly at the entrance of the mall, a guy with a mask and a hood messing around there would have 5 seconds before he is picked up by the guards.

But when you start to deploy 0 confirmation ATMs that can be cut with a 6-inch metal cutting scissor in some back alley even cats ignore .. you're asking for it

[dunfida]

Is that really even a crime? I guess taking the money without paying the BTC is, but I wonder what they are actually going to be charged with (if caught).

Of course it is a crime. It doesn't matter how it happens, and how stupid the ATM operator is, they purposely took someone's money.

It's quite sad that these things are happening, but they're a welcome wake-up call, because this will stimulate other operators of ATM's to at least wait for that confirmation. It legit surprises me how stupid this whole zero-fee ATM setup is in the crypto world with how it's quite easy for con artists to figure out how to game the system.

BitPay for example only allows $25 worth of payments to be accepted instantly, which is tolerable. The fact that they still offer that option means that there is little to no abuse worth taking it down for.

Dont know why i cant be considered as a crime yet you intently get those funds and this do considered stealing on any angles.You are aware on such exploit of that ATM due
to zero confirmation but you do still proceed to took it off.

This is indeed a wake up call for those possible Bitcoin ATM operators/owners out there.Identifying or seeking out those criminals is nearly impossible.

[BitHodler]

How stupid. I can somewhat understand that you don't have to wait for a confirmation when you buy a coffee or a sandwich, but this is something even the worst possible noob doesn't fall for.

It's basic crypto etiquette that you don't accept zero fee transactions as final. In Bitcoin's case one confirmation is the minimum, and in case of certain altcoins multiple confirmations are needed to satisfy me.

When you see whatever entity deploy an ATM you at least expect to deal with people who understand the fundamental basis of Bitcoin. No amount of convenience is worth sacrificing security for....

[gentlemand]

No amount of convenience is worth sacrificing security for....

I hadn't heard of many ATMs that you could sell to. Most of them out there seem to be buy only and tales like this are only going to enforce that. The only way to be sure is to make people wait for the confirmations and they either have to sit there or leave and trust the BTC will arrive. Anyone with any experience here of selling to an ATM?

[stompix]

Anyone with any experience here of selling to an ATM?

Raises hand up!
Can't find the older message where I was telling how much of a pain in the ....it is

So, you go to the ATM, select language, sell, everything is going fine, they ask you the sum (it has two choices under and over 200 euros,  I've chosen over 200) and it begins!

You must present the id to the camera and there goes one pic.
Then the ATM camera gets another selfie of your pretty face.
They ask for a phone number, doesn't have to be valid or yours there is no identification

Then you type down the sum. The ATM spits a QR code with the details to pay x to address y.
Based on the instructions you have 10 minutes to initiate the payment (the guys told me that the transfer will still work for actually 12 hours).
After you complete the transactions, when it gets 2 confirmations you will get a  message on your phone.

With the previous receipt with the QR code, you go to the ATM, select withdraw and scan it again.
Cash comes raining down!!

[gentlemand]

when it gets 2 confirmations you will get a  message on your phone.

That one sounds like they have the right idea then. Did they give you an idea of how long you would have to wait and did they pay for a cup of tea or twenty minutes of soft play? And how good or bad was the rate that it gave you?

[figmentofmyass]

Apparently, the Bitcoin ATMs accepted zero-confirmation transactions, and the men exploited this fact to double-spend Bitcoin in exchange for cash. Over 112 transactions in 10 days netted the scammers a total of around $200,000. The average transaction was around $1800.

it's a shame to see how dumb these companies are. accepting zero confirmations in this day and age? for cash, no less?

all you'd need is a few coins, doublespend.py, a burner phone, and maybe a fake ID to beat that all day every day. it sounds like all police have are these CCTV pictures from the ATMs.

it's too bad the article implies that RBF tools are the problem here. the problem is irresponsible companies who are paying out cash when they haven't first received the bitcoins.

i wonder who the dummy is:

Several different companies including Bitnational, Bitcoin Solutions, and Bitcoiniacs own these ATMs. Some have a daily sales limit up to $9000.

CCN was unable to get any of these companies on the phone. We wanted to inquire whether they allow for 0-confirmation transactions or not.

[stompix]

Did they give you an idea of how long you would have to wait and did they pay for a cup of tea or twenty minutes of soft play? And how good or bad was the rate that it gave you?

I might be wrong but I don't remember anything about the estimated time, or if there was any warning or instruction.

As for the others, yeah I got a nice boot to show me where the door was because the space where the ATM was installed was probably smaller than 2m2, and for that, I remember paying something like 7% on Kraken prices.

As I said many times before about those ATMs, unless they drop the fees below 3% they won't be used more than once by people testing some novelty out of fun. What's worse they aren't fun at all!


Oh, just saw figmentofmyass's post.
http://www.bitcoiniacs.com/what-is-bitcoin/how-to-use-the-atm/

Can't play the video but....

Once you're at the ATM you will be prompted to scan your palm. The palm scanner will read your palm up to 6 times to set up your account.

Does this mean they have their fingerprints also? 

[figmentofmyass]

Oh, just saw figmentofmyass's post.
http://www.bitcoiniacs.com/what-is-bitcoin/how-to-use-the-atm/

Can't play the video but....

Once you're at the ATM you will be prompted to scan your palm. The palm scanner will read your palm up to 6 times to set up your account.

Does this mean they have their fingerprints also? 

i'm guessing it's not the bitcoiniacs machines then. well, i would certainly hope thieves would be smart enough not to give up their fingerprints in the commission of a crime. but there's no accounting for stupidity these days!

when it gets 2 confirmations you will get a  message on your phone.

That one sounds like they have the right idea then. Did they give you an idea of how long you would have to wait and did they pay for a cup of tea or twenty minutes of soft play?

this is why these atms work for buying coins---customers don't even need to wait around, the coins are coming to their address. if you're selling for cash, you could be standing there for an hour waiting for a confirmation. i guess that's the motivation to do zero conf or......palm scanners lol.

[gentlemand]

this is why these atms work for buying coins---customers don't even need to wait around, the coins are coming to their address. if you're selling for cash, you could be standing there for an hour waiting for a confirmation. i guess that's the motivation to do zero conf or......palm scanners lol.

Speaking for myself, the only time I'd have a use for an ATM is selling to. If I was out and about and wanted to purchase hand relief from a desperate single mother at the mall such a thing would be useful. My buying is long done now.

But I don't get how they'd make it safe for all and convenient.

[stompix]

There is a solution, but it's not that simple.

There was a robocoin operator that was running some sort of exchange, I don't remember if it was in Romania or Bulgaria but I think it's the first one, and you could make the transaction online in your account and get your money from the ATM with a security code.

So you could do that exchange whenever you wanted while on your way to the ATM and by the time you arrived you could simply cash out. But it won't help you if you decide to do that when you're 100 meters away from it. 

well, i would certainly hope thieves would be smart enough not to give up their fingerprints in the commission of a crime. but there's no accounting for stupidity these days!

Am I getting this wrong or are you cheering for them not to get caught? 

[figmentofmyass]

well, i would certainly hope thieves would be smart enough not to give up their fingerprints in the commission of a crime. but there's no accounting for stupidity these days!

Am I getting this wrong or are you cheering for them not to get caught?  

haha, i'm not exactly an advocate for criminal behavior but i definitely have a certain respect for criminals who are good at what they do (and don't get caught). i come from a place and ethic where street smarts are important and as a rule you don't talk to police. so to me, someone who gives away thousands in cash for absolutely nothing in return is just a gullible pigeon. idiots like that are bound to be parted from their money one way or another.

people shouldn't run businesses if they don't understand basic human rationality. what these atm operators did is blindly trust and throw free money at literally any random person off the street. such stupidity almost demands they be stolen from!