Police in Calgary are hunting for four men who they believe have between them carried out double-spend attacks on 112 Bitcoin ATMs in the state, making off with some $200,000 CAD ($146,500) in the process. The four criminals have targeted seven cities in the state, making withdrawals from Bitcoin ATMs and then remotely cancelling the transaction before the ATM system has a chance to process it. Calgary police received a tip-off in October 2018 about the scam and after starting an investigation have now identified the perpetrators.
Our Cybercrime Team has launched a joint investigation with @TorontoPolice @HamiltonPolice @wpgpolice @HaltonPolice into a national bitcoin fraud with losses estimated at $195,000. Do you know these suspects? https://t.co/blp15qvSIw pic.twitter.com/WX6Sl8Zcje
— Calgary Police (@CalgaryPolice) March 12, 2019
Double-Spend Attacks
The type of hack the perpetrators used is called a double-spend, which is a flaw that exists because of the desire of convenience in Bitcoin transactions over security. Bitcoin transactions can take some 10-20 minutes to be confirmed due to the required six confirmations, so many ATM operators have agreed to accept zero-confirmation transactions. These are instant but carry an inherent risk whereby a well-versed attacker can take the money and then cancel the transaction before it has been confirmed. This is similar to writing a check you know to be bad in order to receive instantly-delivered goods. ATMs take other precautions to prevent fraud, like embedding CCTV into the machines, although of course these are only effective retrospectively.
The bitcoin ATM start-up @badger_coin that I co-founded in 2016 has been hit with sophisticated fraud. While it was known that accepting 0-confirmation transactions bears risk, there was a trade-off involved: instant and less safe vs long and safe.https://t.co/56WcFCoMeX
— Yuri de Gaia (@Y_deGaia) March 13, 2019
Do You Know These Men?
Calgary police are asking that regardless of jurisdiction, anyone with information about the identity of any of these suspects is asked to call the CPS’s non-emergency line at 403-266-1234. People can also anonymously submit tips through Crime Stoppers.
