GENERAL BYTES

Imagine buying bitcoin with banknotes. Instead of signing into an exchange, you approach a machine and provide your wallet address. GENERAL BYTES supplies technology for this kind of transaction. Its own timeline dates the company’s founding in Prague to 2013 and its first public ATM installation to 2014. Machines sold measures past deliveries; it is neither a directory of currently operating locations nor an independently verified customer count. [1]

If a purchase goes wrong, who operates that particular ATM matters. GENERAL BYTES directs customers with transaction problems to the operator. The manufacturer’s brand alone does not tell you the exchange rate, fee, payment recipient or who handles refunds. Before buying, it therefore makes sense to read the terms and find the service operator’s contact details, rather than knowing only the device maker’s name. [2]

A one-way BATM accepts cash to buy cryptocurrency. A two-way model can also accept cryptocurrency and dispense cash. That does not mean every machine bearing the brand offers both. The model, hardware and operator’s configuration all matter. For example, support for selling bitcoin somewhere in the product range does not guarantee that your chosen machine can dispense banknotes when you visit. [2]

CAS, the central server managing the ATMs, processes requests from the BATM terminal. Depending on its configuration, it communicates with an exchange and hot wallets: wallets available online for ongoing payments. A purchase can therefore send bitcoin from a connected wallet to the customer’s address. The manufacturer says the terminal itself does not hold cryptocurrency. Security extends beyond a sturdy cabinet to access credentials for the server, wallets and connected service accounts. [3]

An operator may need to connect a different exchange or wallet. CAS extensions provide a way to do this. The public batm_public repository includes examples, testing tools and a Java API: an interface through which software written in Java works with the system. Publishing these extensions does not establish that every part of the product is open source. Someone must also maintain a custom extension and check its compatibility with the CAS version in use. [4]

The notice covering 17–18 March 2023 described an attacker running their own application through the server interface. This provided access to the database and API keys, credentials for connected wallets and exchanges. Such credentials can also permit funds to be sent. Recovery therefore involved rebuilding compromised servers and replacing credentials, as well as updating software. Closing the original entry point and invalidating already stolen access are separate tasks. [5]

The report concerning 22 July 2026 described another CAS incident. The company linked it to insufficient hardening of Hessian, a library processing received data, and faulty checking of the terminal’s identifying fingerprint. This means checking the connected device, not a customer’s finger. The manufacturer also reported compromise of its own infrastructure. The earlier 2023 fix therefore cannot establish that this later problem was resolved; each notice has its own scope and recovery steps. [6]

The August update to the 2026 report described a breach of Sentry, a system collecting diagnostic data. The company said attackers may have obtained CAS server addresses and images of QR codes the machines could not decode. According to the manufacturer, these images contained addresses, not private keys. That distinction matters, but the information is still sensitive operational data. ATMs can also verify customers’ identities. Paying with banknotes alone does not make a purchase anonymous. [6] [2]