Security for an anonymous service: protecting Bitcoin ATMs

Martin Koffijberg

The rise of Bitcoin and other cryptocurrencies, also known as altcoins, has been impossible to avoid. The market has hit the mainstream and broad public consciousness, with cryptocurrencies now available to buy on the high street via ATMs. Known as “Bitcoin ATMs”, these allow users to easily purchase cryptocurrencies from a machine, anonymously.

One of the major attractions of cryptocurrencies is the ability to trade without exposing your personal details. This is made possible by cryptocurrencies being based on the blockchain, an open, distributed ledger that can record transactions between two parties efficiently and in a verifiable and permanent way. Therefore, once someone has set up an account to buy and sell cryptocurrencies, they can trade without the transactions being traced to them personally. For more on the blockchain, see our ‘Tech trends shaping 2018’ post.

When digital meets the physical world

With a Bitcoin ATM, those with a Bitcoin address – often in the form of a QR code – can scan their address on the machine and check exchange rates. They then have to enter their phone number for verification purposes (OTC), to make sure it really is them in front of that particular Bitcoin ATM.  Once verified, they can input fiat cash (fiat currencies being traditional ones such as the euro and dollars) and select the cryptocurrency they wish to purchase from the terminal. The machine then takes a commission from the transaction and transfers the rest of the equivalent cash, in the chosen altcoin, to the user’s associated cryptowallet (an account represented by the QR code where cryptocurrency is stored).

The majority of purchases at Bitcoin ATMs are made in cash, which is held in the machine until it is emptied. Furthermore, there are now Bitcoin ATMs emerging that allow users to withdraw fiat cash from their cryptowallets and sell their cryptocurrencies. When there is a drop in the value of Bitcoin, operators see a sharp rise in people selling the cryptocurrency. Bitcoin ATMs need to be able to allow cash to be used to purchase cryptocurrency as well as have enough cash for customers looking to make a  fiat cash withdrawal – so, as with traditional bank ATMs, they must be well stocked with large amounts of bank notes. This presents some interesting challenges for us in the security industry: the Bitcoin ATMs may become a hot target for criminals looking to both rob those with the cash before they can transact or empty the machines themselves.

Bitcoin ATMs are typically not owned by banks and instead connect to a DCE (Digital Currency Exchange). Most DCE’s don’t have the same regulatory levels as banks, meaning they don’t question those using Bitcoin ATMs – there is no need for users to justify where they obtained the funds to purchase the cryptocurrency, making it the perfect solution for those looking to launder money obtained by crime.  This is another conundrum, as adding personal identification also defeats the difficult-to-trace nature of cryptocurrency transactions!

So, the million-Bitcoin question is: how do we protect these machines and their users from those looking for ill-gotten gains?

Balancing privacy with security

While we cannot currently directly correlate a person’s image with a specific transaction at a Bitcoin ATM for verification at the machine, we can implement surveillance cameras in the area for added security. If something were to happen, such as police were able to trace a large money laundering gang to a specific Bitcoin ATM, investigators can look at the video surveillance footage of people at the machine’s location at the time they are suspected of carrying out the criminal activity as vital evidence in their investigations.

That is fine for post-event forensic investigation when someone has committed a crime, but with the potential for criminal damage and violent crime, it is much more important to prevent such crimes from happening in the first place. Video analytics can be an important security feature to detect suspicious persons and/or behaviors in front of a Bitcoin ATM at an early stage. These cameras can be positioned near to or inside the Bitcoin ATMs and send an alert to security personnel if they see suspicious behavior such as loitering or pacing. The security guard can then deploy a team to go and investigate further, halting the criminals in their tracks.

It is worth noting that organizations using security cameras to monitor people anywhere need to ensure the data they collect is protected from security breaches. This is especially vital around Bitcoin ATMs because if external hackers were able to access footage of those using Bitcoin ATMs, they could potentially identify people they think have Bitcoins (or have likely made money from trading them) and target them to steal their assets. Therefore, solid cyber security features to prevent hacking are also critical for video cameras, to protect the identities of those caught on the footage.

As our Global Consumer Perspectives on ATM Safety report has found, globally, 83 per cent of people use a cashpoint to make a withdrawal at least once a month. With such a social norm now being used in the cryptocurrency world of anonymity, it is more important than ever that those hosting these machines consider how to keep them and the public safe.

Find out more about our:

ATM Security Solutions