Cryptocurrency ATM

Physical self-service machines that allow users to buy or sell cryptocurrencies (e.g., Bitcoin) using cash or payment cards. These machines connect to a cryptocurrency exchange for real-time transaction processing and exchange rate updates, providing a convenient interface for converting fiat currency into digital assets and vice versa.

[
Code
PS0051
]
[
Name
Cryptocurrency ATM
]
[
Version
1.0
]
[
Category
Crypto & Digital Asset Services
]
[
Created
2025-03-14
]
[
Modified
2025-04-02
]

Related Techniques

  • Criminals designate ‘Crypto ATM Mules’ to convert illicit cash to cryptocurrency or vice versa, obscuring fund origin.
  • Rapid deposits and withdrawals in fragmented amounts help evade standard currency transaction monitoring.
T0011.002
|
|
  • Mules can deposit or withdraw illicit cash with minimal identification, exploiting weak or non-existent AML controls.
  • Large or repeated deposits and withdrawals facilitate layering, obscuring the true origin and flow of funds.
  • Criminals direct mules to use multiple terminals across different regions, complicating tracing.
  • By converting bulk cash into crypto at these machines, illicit proceeds are more easily moved abroad and detached from their criminal source.
  • Provide direct fiat-to-crypto and crypto-to-fiat conversions with limited or no on-site identification checks.
  • Facilitate rapid, off-the-record cash deposits or withdrawals, impeding law enforcement’s ability to trace transactions when machines operate under minimal compliance obligations.

Co-ordinated or scripted visits to multiple crypto ATMs—each cash deposit just below the ID-verification threshold—feed a wallet network that instantly forwards coins onward, turning street cash into blockchain value with minimal KYC.

  • Traffickers feed physical cash from forced prostitution into crypto ATMs, acquiring digital assets without undergoing typical bank deposit scrutiny.
  • Once converted, these funds can be rapidly transferred across multiple wallets, further concealing the illicit source of proceeds.
  • Criminals can deposit physical cash in small increments below reporting thresholds, avoiding robust identity checks and creating anonymity.
  • The self-service nature and minimal face-to-face scrutiny reduce the likelihood of customer identification, enabling quick placement or layering of illicit proceeds.
  • Loosely regulated or noncompliant operators may permit high-value transactions with limited due diligence, further obscuring the transaction trail.
T0067.001
|
|
  • Permits immediate exchange between cash and payment tokens, which can be exploited via multiple low-value transactions to avoid heightened scrutiny.
  • Some machines operate with minimal ID verification, aiding anonymity and cross-border cash movement.
  • Criminals feed counterfeit cash into machines that have limited or weak authentication of physical banknotes.
  • The fake currency is quickly converted into cryptocurrency, obscuring the transaction’s origin.
  • Permit rapid conversion of darknet-derived crypto to cash or vice versa, often with lax KYC, enabling physical anonymity.
  • Conceal the beneficial owner’s identity by breaking the transaction chain when crypto exits into untraceable cash.
T0144.009
|
|
  • Scammers direct victims to Bitcoin ATMs to convert fiat currency into cryptocurrency, often with minimal identity checks.
  • This conversion process facilitates quick cross-border movement of illicit proceeds, bypassing traditional banking oversight.

Enables fast cash-out (or cash-in) of mined coins below ID thresholds; physical cash extraction severs the digital audit trail.