U.S. authorities have seized over $23 million in cryptocurrency linked to the theft of $150 million from a Ripple crypto pockets in January 2024. Investigators consider hackers who breached LastPass in 2022 had been behind the assault.
Regardless of the menace actors’ efforts, regulation enforcement brokers traced $23,604,815.09 of the stolen digital belongings between June 2024 and February 2025 to the next cryptocurrency exchanges: OKX, Payward Interactive, Inc. (dba Kraken), WhiteBIT, AscendEX Know-how SRL, Ftrader Ltd (dba FixedFloat), SwapSpace LLC, and Rabbit Finance LLC (dba CoinRabbit).
A forfeiture criticism unsealed by the U.S. Justice Division yesterday and first noticed by crypto fraud investigator ZachXBT reveals that U.S. Secret Service brokers who interviewed the sufferer consider the attackers might have solely stolen the cryptocurrency utilizing personal keys extracted by cracking the sufferer’s password vault stolen in a 2022 breach of an internet password supervisor.
They discovered that the stolen information and passwords saved in a number of victims’ password supervisor accounts had been utilized by attackers to entry “their digital accounts and steal data, cryptocurrency, and different information.”
Additionally they found no proof that the sufferer’s units had been hacked, which factors to the decryption of the stolen on-line password supervisor information as the one means the attackers might have obtained the keys wanted to compromise the sufferer’s crypto pockets.
“The size of a theft and speedy dissipation of funds would have required the efforts of a number of malicious actors, and was in step with the net password supervisor breaches and assault on different victims whose cryptocurrency was stolen,” the criticism reads.
“For these causes, regulation enforcement brokers consider the cryptocurrency stolen from Sufferer was dedicated by the identical attackers who performed the assault on the net password supervisor, and cryptocurrency thefts from different equally located victims.”
Crypto theft linked to LastPass hacks
Whereas the investigators did not identify the on-line password supervisor, the criticism says that the platform was hit by “two main information breaches” in August 2022 and November 2022.
This timeline aligns with safety breaches disclosed by LastPass three years in the past when the corporate mentioned that attackers stole supply code and proprietary technical data, in addition to buyer vault information, after breaching its cloud storage.
Since then, a number of safety specialists have shared that they consider the LastPass hackers have cracked among the stolen vault information and used the extracted personal keys and credentials in main cryptocurrency heists.
Although the investigators did not establish the sufferer, the small print match the hack and the theft of $150 million in cryptocurrency from Ripple co-founder and govt chairman Chris Larsen, which was disclosed on January 31, 2024.
ZachXBT first linked the $23 million in cryptocurrency seized this week and the hack of Larsen’s XRP pockets.
“A forfeiture criticism filed yesterday by US regulation enforcement revealed the trigger for the ~$150M (283M XRP) hack of Ripple co-founder, Chris Larsen’s pockets in Jan 2024 was the results of storing personal keys in LastPass (password supervisor which was hacked in 2022),” he mentioned right now in a Telegram message.
A Ripple spokesperson was not instantly out there when BleepingComputer reached out for remark earlier right now.
Replace March 07, 14:40 EST: LastPass despatched the next assertion after publishing time:
Since we initially disclosed this incident again in 2022, LastPass has labored in shut cooperation with a number of representatives from regulation enforcement. Up to now, our regulation enforcement companions haven’t made us conscious of any conclusive proof that connects any crypto thefts to our incident.
