The Bitcoin ATM operator disclosed a hack two weeks after attackers gained control of settlement account credentials and stole BTC.