https://arstechnica.com/information-technology/2023/03/hackers-drain-bitcoin-atms-of-1-5-million-by-exploiting-0-day-bug/
https://www.generalbytes.com/en/news/general-bytes-statement-on-the-security-incident-that-occurred-on-march-18-2023

v skratke:
hackeri poskenovali digitalocean a nasli si ipcky a servicy ktore im patria
nasli endpoint ce ktory sa uploadovali videa a obrazky na identifikaciu usera
cez tento endpoint vedeli nahrat vlastnu java aplikaciu, a spustit(toto je velike wtf)
tymto to viacmenej nakompletku pwnli

This resulted in the following:
- Ability to access the database.
- Ability to read and decrypt API keys to access funds in hot wallets and exchanges.
- Send funds from hot wallets.
- Download user names and their password hashes and turn off 2FA.
- Ability to access terminal event logs and scan for any instance where customers scanned private keys at the ATM. Older versions of ATM software were logging this information.

cele to bol vraj 0day exploit. A danu zranitelnost predtym neodhalili ziadne pentesty (este vacsie WTF)

akoze ked takuto chybu ala diery v PHP aplikaciach z roku 2000 pentest neodhali tak to je ze total lamerina. ak teda tie pentesty ozaj davali robit.