Blockchain investigation firm TRM Labs has linked ongoing cryptocurrency thefts to the LastPass breaches disclosed in 2022, demonstrating how attackers continue to exploit stolen encrypted password vaults years later.
What happened
In 2022, attackers:
- Compromised a LastPass developer environment
- Stole source code and proprietary technical data
- Later breached GoTo cloud storage using reused credentials
- Exfiltrated LastPass database backups, including encrypted user vaults
Some of those vaults contained cryptocurrency private keys and seed phrases.
Why did the thefts happen years later
Although the vaults were encrypted, users with weak or reused master passwords were vulnerable to offline cracking.
Rather than draining wallets immediately, attackers:
- Gradually decrypted vaults over time
- Extracted private keys
- Drained wallets in distinct waves, months or years later
“Wallet drains occurred well after the original breach — not immediately.”
— TRM Labs
Evidence from law enforcement
The U.S. Secret Service confirmed the pattern in 2025 after seizing $23M+ in cryptocurrency, stating:
- Victims’ devices were not infected with malware
- No phishing evidence was found
- Private keys were obtained by decrypting stolen password vaults
Laundering via CoinJoin
After draining wallets, attackers:
- Converted assets to Bitcoin
- Used Wasabi Wallet’s CoinJoin feature to obscure transactions
- Attempted to hide activity via mixing
Despite this, TRM successfully demixed transactions by analyzing:
- Timing patterns
- Transaction structure
- Wallet configuration behavior
Scale of the theft
TRM estimates:
- $28M+ stolen in late 2024 / early 2025
- $7M more in a later wave (September 2025)
Funds were repeatedly cashed out via Russian-linked exchanges, including Cryptex and Audi6, pointing to a single coordinated threat group.
Key takeaway
This case highlights a long-tail risk of breaches:
- Encrypted data can still be dangerous
- Weak passwords enable years-long exploitation
- Password managers storing crypto secrets require extreme care
If you stored crypto keys in a password manager impacted by past breaches, assume long-term exposure risk.
