Cybersecurity

The November 3 US midterms passed without significant cyber incidents, GovTech reports. Overnight reports from the election-security information-sharing center described one office facing failed exploitation attempts, a small number facing denial-of-service attacks or heavy web traffic, brief website interruptions, misleading text messages and a handful of bomb threats; none appeared to significantly limit voting. Former CISA director Chris Krebs told NPR it was "just another Tuesday on the internet."

Washington Secretary of State Steve Hobbs confirmed a cyberattack on his office's website, KOMO reports; some pages were briefly unavailable amid bot traffic, and he said the counties' tabulators are not connected to the internet. Colorado's election-night results site went down for about 45 minutes; its vendor, SOE Software, blamed unusually high automated traffic from results-scraping services across several vendors, and the state said ballots and results were unaffected.

The biggest problems were not cyberattacks: ballot scanners rejected ballots in most of Westchester County, New York, after a late programming change, and some Pennsylvania scanners jammed.

Records released to the Electronic Frontier Foundation and other requesters under the Freedom of Information Act show the US Postal Service's internet Covert Operations Program (iCOP) monitored social media posts about protests in 2020 and 2021, with little record of oversight or legal justification, EFF says. Bulletins covered events across the political spectrum, including a planned "Million MAGA March," a Virginia gun-rights rally and counter-protest, a Save the Post Office protest and protests outside then-Postmaster General Louis DeJoy's home.

EFF sued in 2021 after Yahoo News revealed the program. The agency says it renamed the program and stopped issuing bulletins, but EFF notes the records don't say the monitoring stopped. Emails about the program were kept on an external hard drive that, officials said, someone dropped, making it unreadable; the originals had already been deleted under the retention schedule. Few documents on internal safeguards were released.

Binance has published an incident report on the theft of about $6.3 billion on October 29, which TRM Labs calls the largest cryptocurrency theft on record. According to The Register, the FBI attributed it over the weekend to TraderTraitor, a North Korean operation linked to the Lazarus Group; TRM and Chainalysis had already named the same unit.

Binance describes a months-long intrusion, not a single phishing email. In June an engineer downloaded a malicious Homebrew installer; staff caught it and replaced the device. In September a second engineer was approached on a job-hunting platform and taken through fake interviews, the last with someone posing as a CEO who asked them to download a code "assignment" that carried malware. On October 20 the attackers used that machine and an internal AI tool to reach two wallet engineers' computers, and on October 29 they used a stolen container-deployment token to launch the theft.

TRM told WIRED the wallets on at least ten blockchains were drained in about 20 minutes, after test runs on smaller wallets. Binance says it will cover all losses and has rebuilt the wallet system and the AI tool.

When Binance reopened withdrawals on Sunday, November 1, it processed $4.65 billion out and $1.01 billion in, for $3.64 billion in net outflows (about 2.1% of its $171 billion in assets), CNBC reports. Bitcoin slid about 4% on Friday, less than the 8.3% average first-day drop after past exchange hacks, per Anchorage Digital data cited by CNBC.