How not to steal $46 million from the US government
From Smashing Security by Graham Cluley
March 12, 2026 · 41 min · Episode 458
About this episode
The episode discusses a dormant JavaScript worm that was activated and a crypto contractor who allegedly stole $46 million from the US government.
A Wikipedia security engineer accidentally wakes a dormant JavaScript worm that hadn't stirred since 2024 - and within minutes, giant woodpecker images are plastered across the internet's favourite encyclopaedia. Meanwhile, a crypto contractor hired to help the US Marshals manage seized digital assets allegedly decides to help himself to $46 million of it - and then brags about it on a recorded Telegram call. Plus: Graham champions Asterix, Trisha discovers the fantasy novels of Robin Hobb, and someone called "Lick" ends up in the nick. All this, and much more, in episode 458 of the "Smashing Security" podcast with cybersecurity veteran Graham Cluley, and special guest Tricia Howard. EPISODE LINKS: Major data leak forum dismantled in global action against cybercrime forum - Europol. Ericsson blames vendor vishing slip-up for breach exposing thousands of records - The Register. How hackers bypassed MFA with a $120 phishing kit – until law enforcement shut them down - Hot for Security. Wikipedia hit by self-propagating JavaScript worm that vandalized pages - Bleeping Computer. FBI arrests crypto thief accused of stealing $46 million from seized government wallet - Tom’s Hardware…
People in this episode
Host: Graham Cluley
Guest: Tricia Howard
Topics covered
- cybersecurity
- crypto theft
- JavaScript worm
- data breach
- digital assets
- vandalism
- fantasy novels
Keywords
- JavaScript worm
- crypto theft
- US Marshals
- Wikipedia
- cybersecurity
- data breach
- Asterix
- Robin Hobb
- Telegram call
- vandalism
Sponsors
Vanta
Mentioned in this episode
Organizations: Wikipedia, US Marshals, Europol, The Register, Hot for Security, Bleeping Computer, Tom’s Hardware
Books & works: Asterix, Robin Hobb . The Complete Farseer trilogy
More episodes of Smashing Security
- This AI worm just rewrote its own rules · June 10, 2026 · 46 min
- This AI security flaw might be impossible to fix · June 3, 2026 · 58 min
- What your Oura ring won't tell you · May 27, 2026 · 53 min
- High-speed train hacks and homicidal lawnmowers · May 20, 2026 · 56 min
- How ShinyHunters hacked the world's biggest universities · May 13, 2026 · 1h 4m
- Meta sees everything, Copy Fail, and a deepfake gets hired · May 6, 2026 · 1h 3m
Explore listener stats, chart rankings, contacts and more on the Smashing Security podcast page.