FBI says ATM ‘jackpotting’ attacks are on the rise, and netting hackers millions in stolen cash

In 2010, the famed security researcher Barnaby Jack spectacularly hacked into an ATM cash machine onstage at the Black Hat security conference, forcing it to spit out reams of bank notes in front of an awestruck audience. More than a decade later, ATM jackpotting — as it’s called — has broken free from the realms of theoretical security research into big business in the criminal world. According to a new security bulletin issued by the FBI, hackers have rapidly ramped up their attacks in recent years, with more than 700 attacks on cash dispensers during 2025 alone, netting hackers at least $20 million in stolen cash. Per the bulletin, the FBI says hackers are using a mix of physical access to ATM machines, such as generic keys for unlocking front panels and accessing hard drives, and digital tools, like planting malware that can force ATMs to rapidly dispense cash in a flash. The FBI warned that one particular malware, known as Ploutus, affects a variety of ATM manufacturers and cash dispensers by targeting the underlying Windows operating system that powers many ATMs. Ploutus grants the hackers full control over a compromised ATM, allowing them to issue instructions capable of tricking the dispenser into disbursing notes without drawing funds from customer accounts. Ploutus takes advantage of extensions for financial services, or XFS software, which ATMs rely on to communicate with its various other hardware components, such as the PIN keypad, the card reader, and the all-important cash dispensing unit. “Ploutus attacks the ATM itself rather than customer accounts, enabling fast cash-out operations that can occur in minutes and are often difficult to detect until after the money is withdrawn,” per the FBI bulletin. Security researchers previously found issues with XFS software that can allow hackers to trick ATMs into dispensing cash. Barnaby Jack, the late security researcher credited with the first ATM “jackpotting” attacksImage Credits:YouTube Updated the lede paragraph to amend date. Topics ATM, cash machine, cyberattacks, cybersecurity, jackpotting, Security Zack Whittaker Security Editor Zack Whittaker is the security editor at TechCrunch. He also authors the weekly cybersecurity newsletter, this week in security. He can be reached via encrypted message at zackwhittaker.1337 on Signal. You can also contact him by email, or to verify outreach, at zack.whittaker@techcrunch.com.

View Bio October 13-15 San Francisco, CA Save up to $680 on your pass before February 27.Meet investors. Discover your next portfolio company. Hear from 250+ tech leaders, dive into 200+ sessions, and explore 300+ startups building what’s next. Don’t miss these one-time savings. REGISTER NOW Most Popular Meta’s own research found parental supervision doesn’t really help curb teens’ compulsive social media use Sarah Perez How Ricursive Intelligence raised $335M at a $4B valuation in 4 months Julie Bort After all the hype, some AI experts don’t think OpenClaw is all that exciting Amanda Silberling OpenClaw creator Peter Steinberger joins OpenAI Anthony Ha Hollywood isn’t happy about the new Seedance 2.0 video generator Anthony Ha The great computer science exodus (and where students are going instead) Connie Loizos A Stanford grad student created an algorithm to help his classmates find love; now, Date Drop is the basis of his new startup Amanda Silberling