Hot Take LastPass 2022 Breach Led to Years-Long Cryptocurrency Thefts, TRM Labs Finds

[Parkinsond]

"As users failed to rotate passwords or improve vault security, attackers continued to crack weak master passwords years later – leading to wallet drains as recently as late 2025."

The blockchain intelligence firm said evidence points to the involvement of Russian cybercriminal actors in the activity, with one of the Russian exchanges receiving LastPass-linked funds as recently as October.

The stolen funds have been found to be routed through Cryptomixer.io and off-ramped via Cryptex and Audia6, two Russian exchanges associated with illicit activity. It's worth mentioning here that Cryptex was sanctioned by the U.S. Treasury Department in September 2024 for receiving over $51.2 million in illicit funds derived from ransomware attacks.

Earlier this month, the password management service was fined $1.6 million by the U.K. Information Commissioner's Office (ICO) for failing to implement sufficiently robust technical and security measures to prevent the incident.

LastPass 2022 Breach Led to Years-Long Cryptocurrency Thefts, TRM Labs Finds

Stolen LastPass vaults from the 2022 breach enabled about $35M in crypto thefts through 2025, according to TRM Labs.

thehackernews.com

 

[Wrecker4923]

Original Source:

TRM Traces Stolen Crypto from 2022 LastPass Breach — On-chain Indicators Suggest Russian Cybercriminal Involvement | TRM Blog

TRM traced LastPass-linked Bitcoin laundering through mixers to high-risk Russian exchanges, showing how demixing exposes infrastructure reuse and limits mixer anonymity.

www.trmlabs.com

In 2022, a threat actor gained access to encrypted vault data stored by LastPass. As users failed to rotate passwords or improve vault security, attackers continued to crack weak master passwords years later — leading to wallet drains as recently as late 2025.
...
Many affected LastPass users failed to change or secure master passwords, and their vaults still contained private keys. As threat actors brute-force vaults over time, slow-drip wallet draining has become a recurring pattern.

It's interesting how the blockchain intelligence company attributes the possible actors in this case, but their mitigation analysis is likely off the mark. The problem is that users kept their seed phrases in their LastPass vaults, protected by either weak passwords, outdated KDF, or both. Changing the online password wouldn't have helped; the attackers already had the information from the already exfiltrated vaults with weak encryption. They cracked the vaults that they already possessed. LastPass users should have moved their assets out of the wallets associated with the affected seeds long ago but didn't.

These "security experts" keep recommending poor mitigations; no wonder some LastPass users never got ahead of the curve.

 

[Parkinsond]

LastPass users should have moved their assets out of the wallets associated with the affected seeds long ago but didn't

lazy-user syndrome

 

[Zero Knowledge]

lazy-user syndrome

Not everyone reads security blogs, articles or forums. I imagine there are a few lazy crypto users who just loaded coins into their wallet, wrote the seed in LastPass and left it be.

 

[Parkinsond]

Not everyone reads security blogs, articles or forums

Few hours of reading can save lots of money and more hours trying to contain damage.

 

[Zero Knowledge]

Few hours of reading can save lots of money and more hours trying to contain damage.

Yeah but you forget people have busy lives, they work 8 to 12 hours a day and in the case of nurses, teachers and doctors are on their feet and on call 24/7.

I imagine people who had their wallet hacked due to LastPass probably bought coins when they were worthless or much less, then wrote seed in LastPass and forgot about it.

 

[Parkinsond]

Yeah but you forget people have busy lives, they work 8 to 12 hours a day and in the case of nurses, teachers and doctors are on their feet and on call 24/7

30 min daily on forums such as MT is more than enough; they do not have to read all the posts (especially the AI-generated copied text).
People spend hours daily on worthless YT videos.

 

[Sorrento]

Excuse me here: But are you people saying there are OTHER sites apart from MalwareTips?? I've always thought this is the only site there was & paying for fast fibre was a bit of overkill as I only go on this site, set me straight here??

 

[Parkinsond]

But are you people saying there are OTHER sites apart from MalwareTips??

It's the best

 

[TairikuOkami]

Few hours of reading can save lots of money and more hours trying to contain damage.

Like people storing passwords with 2FA in the same password manager, basically rendering 2FA useless.
ISP gave me a book about security, it is simple, like Ten Commandments, people ignore it, till it is too late.
For example something as simple as card limit?! Default was 12k, I never had so much money, I set it to 100.

"As users failed to rotate passwords or improve vault security, attackers continued to crack weak master passwords years later – leading to wallet drains as recently as late 2025."

They seem to fail on basic security news, regular changing password is considered insecure now, it forces people to use weak passwords and it is what phishing uses.

https://specopssoft.com/blog/nist-password-guidelines/#2-don-t-expire-passwords-too-frequently

 

[Parkinsond]

Like people storing passwords with 2FA in the same password manager, basically rendering 2FA useless.
ISP gave me a book about security, it is simple, like Ten Commandments, people ignore it, till it is too late.
For example something as simple as card limit?! Default was 12k, I never had so much money, I set it to 100.

View attachment 294013


They seem to fail on basic security news, regular changing password is considered insecure now, it forces people to use weak passwords and it is what phishing uses.

https://specopssoft.com/blog/nist-password-guidelines/#2-don-t-expire-passwords-too-frequently

That is why reading and gaining knowledge is mandatory, not luxurious.