Crypto Theft Attacks Now Linked to 2022 LastPass Data Breach: Your Digital Vault Wasn’t So Secure
Your password manager just became your biggest liability. A wave of sophisticated cryptocurrency thefts is now being traced directly back to the 2022 LastPass data breach—proving that even the tools we trust to guard our digital fortunes can become the weakest link.
The Anatomy of a Modern Heist
Forget brute force. These attacks are surgical. Threat actors who infiltrated LastPass's systems years ago have been sitting on a trove of encrypted password vaults. Now, they're cracking them open, not with supercomputers, but with targeted phishing, credential stuffing, and sheer patience—turning stored seed phrases and exchange logins into direct withdrawals from digital wallets. It's a chilling reminder: in crypto, your security is only as strong as your most compromised service.
Why This Breach Keeps on Giving
The 2022 breach wasn't a one-time data dump; it was a gift that keeps on taking. The stolen vaults contained metadata—website URLs, usernames—that painted a bullseye on crypto holders. Attackers didn't need to decrypt everything at once. They just needed to identify high-value targets and apply relentless pressure. The result? A slow-burn crisis where victims are only discovering the thefts now, long after the initial hack faded from headlines.
The Unspoken Rule of Digital Finance
Here's the cynical finance jab: In traditional banking, you get fraud protection and maybe a sympathetic manager. In crypto, you get a blockchain ledger—immutably recording your mistake forever while offering a masterclass in personal accountability. The promise of being your own bank comes with the fine print: you're also the entire security, compliance, and reimbursement department.
This isn't just a hack. It's a paradigm puncture. It exposes the fragile chain of trust in self-custody and forces a brutal question: if we can't secure the keys to the kingdom, what are we really building? The market might bounce back, but trust, once drained from a wallet, is far harder to recover.
Cryptocurrency theft attacks linked to LastPass breach
During the breach, LastPass claimed that its vaults were encrypted. However, users with weak or reused master passwords were vulnerable to offline cracking, which TRM Labs believes has been ongoing since the breach occurred. “Depending on the length and complexity of your master password and iteration count setting, you may want to reset your master password,” warned LastPass when they disclosed the breach.
The link between the LastPass breaches and the cryptocurrency thefts was also confirmed by the United States Secret Service last year after the agency seized more than $23 million in crypto and said the attackers had obtained the private keys of their victims by decrypting vault data stolen in a password manager breach. Court filings also mentioned that there was no evidence that the victims’ devices had been compromised through malware or phishing.
In its report, TRM Labs connected the ongoing crypto theft to the abuse of the encrypted LastPass vaults stolen in 2022. Rather than the hackers moving swiftly to drain the entire wallets after the breach, the thefts have been carried out in waves, months or years after the incident occurred. It also shows that attackers have been gradually decrypting vaults and extracting stored credentials. In addition, the wallets were drained using similar transaction methods.
TRM Labs also mentioned that the method used during the breach showed that the hackers possessed the private keys before the thefts. “The linkage in the report is not based on direct attribution to individual LastPass accounts, but on correlating downstream on-chain activity with the known impact pattern of the 2022 breach,” TRM said. The platform noted that it created a scenario in which the wallet occurs in the future, rather than immediately after the breach happened.
TRM Labs highlights the use of Wasabi’s CoinJoin feature
The platform also mentioned that its research was initially based on a small number of reports, including several submissions made to Chainabuse, where users identified the LastPass breach as the method the hackers used to steal their wallets. The researchers increased their investigation, identifying cryptocurrency transaction behavior across other cases, eventually linking it to the data theft campaign.
TRM also added that it was able to trace funds even after the attackers mixed them using Wasabi wallet’s CoinJoin feature. CoinJoin is a Bitcoin privacy technique that includes all transactions from multiple users into a single transaction, making it harder to determine which input corresponds to which output. The feature obfuscates transactions without using a traditional mixing service.
After draining wallets, the hackers usually convert stolen assets to Bitcoin, route them through Wasabi Wallet, and attempt to hide their tracks using the feature. However, TRM mentioned that it was able to demix the bitcoin sent using the CoinJoin feature by analyzing behavioral characteristics, such as transaction structure, timing, and wallet configuration choices. It was also able to match deposits with withdrawal patterns that matched the crypto theft.
Join a premium crypto trading community free for 30 days - normally $100/mo.
