LastPass 2022 Breach Led to Years-Long Cryptocurrency Thefts, TRM Labs Finds

A shocking revelation has rocked the crypto world: the didn’t just expose user data—it unleashed a multi-year crime spree that’s still draining cryptocurrency wallets as late as 2025. Blockchain intelligence experts at TRM Labs have uncovered how hackers exploited stolen encrypted vaults, cracking weak master passwords to steal over $35 million in digital assets.

This isn’t ancient history. Funds linked to the breach have flowed into Russian exchanges as recently as October 2025. In a digital age where your password manager is supposed to be your fortress, this story exposes a chilling vulnerability that lingers years after the initial hack.

What Happened in the LastPass 2022 Breach?

Back in 2022, LastPass, one of the most popular password managers, fell victim to a sophisticated cyberattack. Hackers infiltrated the company’s systems and made off with encrypted vault backups containing sensitive user information. These vaults held everything from login credentials to cryptocurrency private keys and seed phrases—the golden tickets to billions in digital wealth.

LastPass warned users at the time: attackers could use brute-force attacks to guess weak master passwords and unlock the vaults offline. Many ignored the advice or couldn’t be bothered to upgrade their security. Fast-forward to today, and TRM Labs confirms those warnings were prophetic. Cybercriminals have been patiently cracking vaults, siphoning funds quietly over years.

“Any vault protected by a weak master password could eventually be decrypted offline, turning a single 2022 intrusion into a multi-year window for attackers to quietly crack passwords and drain assets over time.”

The result? Wallet drains continuing into late 2025, long after users might have forgotten about the breach.

TRM Labs Traces $35 Million in Stolen Crypto

Using cutting-edge blockchain forensics, TRM Labs pieced together a trail of theft totaling more than $35 million. Here’s the breakdown:

• $28 million converted to Bitcoin and laundered through Wasabi Wallet from late 2024 to early 2025.
• Another $7 million tied to a fresh wave of thefts spotted in September 2025.

The stolen assets didn’t just vanish. Thieves routed them through mixers like Cryptomixer.io, employing CoinJoin techniques to obscure the trail. From there, funds funneled into high-risk Russian exchanges: Cryptex and Audia6.

Cryptex, notably, was slapped with U.S. Treasury sanctions in September 2024 for handling over $51.2 million from ransomware scams. Despite these red flags, it served as a key off-ramp for LastPass-linked crypto.

Russian Cybercriminals: The Prime Suspects

TRM Labs points the finger at Russian cybercriminal actors based on ironclad on-chain evidence:

• Repeated ties to Russia-linked infrastructure.
• Control continuity before and after mixing funds.
• Exclusive use of risky Russian exchanges for cashing out.

These aren’t isolated coincidences. The laundering pipeline screams Russian cybercrime ecosystem—from mixers to off-ramps. Even advanced obfuscation like CoinJoin couldn’t hide the patterns: clustered withdrawals, peeling chains, and direct hops to sanctioned platforms.

TRM Labs “demixed” the activity, revealing how thieves maintained operational links across the entire flow. This level of attribution shows why blockchain analysis is crypto’s best defense against invisible thieves.

LastPass Faces the Music: $1.6 Million Fine

The breach’s fallout continues. Just this month, the U.K.’s Information Commissioner’s Office (ICO) hit LastPass with a $1.6 million fine. Regulators cited inadequate technical safeguards that allowed the hack to happen.

It’s a stark reminder: even “secure” password managers aren’t bulletproof. Users store crypto keys there assuming ironclad protection, but weak master passwords turn them into ticking time bombs.

“This is a clear example of how a single breach can evolve into a multi-year theft campaign,” said Ari Redbord, global head of policy at TRM Labs. “Even when mixers are used, operational patterns, infrastructure reuse, and off-ramp behavior can still reveal who’s really behind the activity.”

Why Crypto Wallets Are Prime Targets

Cryptocurrency thefts from password vaults highlight a perfect storm:

1. High Value: Private keys unlock unlimited funds—no bank reversals.
2. Offline Cracking: Hackers work at leisure without alerting victims.
3. Long Tail: Weak passwords mean delayed drains, evading quick detection.
4. Laundering Ease: Mixers and rogue exchanges clean dirty crypto fast.

TRM Labs notes Russian exchanges remain cybercrime hubs. Their role as “off-ramps” underscores the need for global crackdowns and advanced tools like demixing.

Lessons Learned: Protect Your Crypto Now

Don’t be the next victim of the aftermath. Here’s how to bulletproof your setup:

• Use Strong, Unique Master Passwords: 20+ characters, diceware style. Avoid dictionary words.
• Enable Multi-Factor Authentication (MFA): Hardware keys like YubiKey beat SMS.
• Rotate Credentials Regularly: Change passwords post-breach alerts.
• Hardware Wallets Over Software: Keep keys offline in Ledger or Trezor—never in password managers.
• Multi-Sig Wallets: Require multiple approvals for big transactions.
• Monitor On-Chain Activity: Tools like TRM or wallet explorers flag suspicious moves.
• Audit Vaults: Check for weak entries and migrate sensitive data.

Pro tip: If you used LastPass for crypto in 2022, sweep those wallets to new addresses today.

The Bigger Picture: Blockchain Forensics to the Rescue

Stories like this prove blockchain’s transparency is a double-edged sword—for criminals, it’s a maze; for investigators, a roadmap. TRM Labs’ work shows demixing and ecosystem analysis are game-changers for enforcement.

“Russian high-risk exchanges continue to serve as critical off-ramps for global cybercrime,” Redbord added. “This case shows why demixing and ecosystem-level analysis are now essential tools for attribution and enforcement.”

As crypto adoption surges, expect more such long-tail breaches. Stay vigilant, prioritize security, and lean on blockchain intel to fight back.

Final Thoughts

The saga is a wake-up call. One hack in 2022 fuels crimes in 2025, costing users millions. By understanding the mechanics—from brute-force cracks to Russian laundering—you can safeguard your assets.

Crypto’s future is bright, but only if we build it on unbreakable security foundations. What’s your take? Share in the comments below.