Blockchain investigation agency TRM Labs says ongoing cryptocurrency thefts have been traced to the 2022 LastPass breach, with attackers draining wallets years after encrypted vaults had been stolen and laundering the crypto via Russian exchanges.
In 2022, LastPass disclosed that attackers breached its techniques by compromising a developer setting, stealing parts of the corporate’s supply code and proprietary technical data.
In a later, however associated safety incident, the hackers breached the cloud storage agency GoTo utilizing beforehand stolen credentials and stole LastPass database backups saved on the platform. For some prospects, these encrypted password vaults not solely contained credentials, however additionally cryptocurrency pockets non-public keys and seed phrases.
Whereas the vaults had been encrypted, customers with weak or reused grasp passwords had been weak to offline cracking, which is believed to have been ongoing for the reason that breach.
“Relying on the size and complexity of your grasp password and iteration rely setting, chances are you’ll need to reset your grasp password,” warned LastPass once they disclosed the breach.
The hyperlink between the LastPass breaches and crypto thefts was additional corroborated by the U.S. Secret Service, which in 2025 seized greater than $23 million in cryptocurrency and stated attackers had obtained victims’ non-public keys by decrypting vault knowledge stolen in a password supervisor breach.
In courtroom filings, brokers stated there was no proof the victims’ units had been compromised via phishing or malware, and that they believed the theft was linked to the stolen password vaults.
Crypto thefts linked to LastPass breach
In a report revealed final week, TRM stated that ongoing cryptocurrency theft assaults have been traced to the abuse of the encrypted LastPass password vaults stolen in 2022.
Relatively than the pockets being drained instantly after a breach, the thefts had been in waves months or years later, illustrating how the attackers steadily decrypting vaults and extracting saved credentials.
The affected wallets had been drained utilizing related transactions strategies, with no reviews of a brand new assault, indicating the attacker possessed the non-public keys earlier than the thefts.
“The linkage within the report isn’t based mostly on direct attribution to particular person LastPass accounts, however on correlating downstream on-chain exercise with the identified impression sample of the 2022 breach,” TRM instructed BleepingComputer.
“That created a situation during which pockets drains would happen effectively after the unique breach, quite than instantly, and in distinct waves.”
TRM instructed BleepingComputer its investigation was initially based mostly on a small variety of reviews, together with submissions to Chainabuse, during which customers recognized the LastPass breach as the strategy their wallets had been stolen.
Researchers expanded their investigation by figuring out cryptocurrency transaction conduct throughout different circumstances, linking the thefts to the LastPass knowledge theft marketing campaign.
TRM instructed BleepingComputer that probably the most vital a part of their analysis was the power to hint stolen funds even after they had been combined utilizing Wasabi Pockets’s CoinJoin characteristic.
CoinJoin is a Bitcoin privateness approach that mixes transactions from a number of customers right into a single transaction, making it tougher to find out which inputs correspond to which outputs.
Wasabi Pockets consists of CoinJoin as a built-in characteristic, permitting customers to routinely combine their Bitcoin with others to obfuscate transactions with out counting on a mixing service.
After draining wallets, attackers transformed stolen crypto to Bitcoin, routed them via Wasabi Pockets, and tried to cover their tracks utilizing CoinJoin transactions.
Nonetheless, TRM says it was in a position to “demix” the cryptocurrency despatched through CoinJoin transactions by analyzing behavioral traits, similar to transaction construction, timing, and pockets configuration selections.
“Relatively than making an attempt to demix particular person thefts in isolation, TRM analysts analyzed the exercise as a coordinated marketing campaign, figuring out clusters of Wasabi deposits and withdrawals over time. Utilizing proprietary demixing strategies, analysts matched the hackers’ deposits to a particular withdrawal cluster whose combination worth and timing carefully aligned with the inflows, an alignment statistically unlikely to be coincidental.
Blockchain fingerprints noticed previous to mixing, mixed with intelligence related to wallets after the blending course of, constantly pointed to Russia-based operational management. The continuity throughout pre-mix and post-mix levels strengthens confidence that the laundering exercise was performed by actors working inside, or carefully tied to, the Russian cybercrime ecosystem.”
❖ TRM Labs
By treating the thefts as a coordinated marketing campaign quite than particular person compromises, TRM was in a position to match teams of Wasabi deposits with withdrawal patterns that matched the crypto theft assaults through the LastPass breach.
Early withdrawals after the pockets drains additional point out the identical menace actors who stole the funds had been behind the blending exercise.
Utilizing this method, TRM estimates that greater than $28 million in cryptocurrency was stolen and laundered via Wasabi Pockets in late 2024 and early 2025. An extra $7 million was tied to a later wave of assaults in September 2025.
TRM says the funds had been repeatedly cashed out through the identical Russian-linked exchanges, together with Cryptex and Audi6, additional indicating that the identical menace actors had been behind these breaches.
It is finances season! Over 300 CISOs and safety leaders have shared how they’re planning, spending, and prioritizing for the 12 months forward. This report compiles their insights, permitting readers to benchmark methods, determine rising traits, and evaluate their priorities as they head into 2026.
Learn the way prime leaders are turning funding into measurable impression.
