Cryptocurrency theft attacks related to the 2022 LastPass leak

TRM Labs, a blockchain investigation company, reports that a series of cryptocurrency thefts spanning several years are directly linked to the 2022 data leak of the LastPass password manager. According to TRM, hackers stole encrypted data repositories and then secretly decrypted them over time to obtain private keys and seed phrases of cryptocurrency wallets, subsequently withdrawing assets in multiple rounds, even years after the incident.

Although LastPass affirms that vaults are encrypted, users with weak or reused master passwords still face the risk of offline cracking. This has been confirmed by the US Secret Service when seizing over $23 million in digital assets, indicating that attackers obtained wallet keys from stolen data rather than through malware or phishing.

TRM also discovered that hackers used Wasabi Wallet’s CoinJoin to obfuscate transaction flows, but they can still be traced through behavioral analysis on the blockchain.