LastPass 2022 Breach Enabled Years-Long Cryptocurrency Thefts with Over $35M Laundered Through Russian Exchanges, TRM Labs Reports

Executive Summary

The 2022 breach of LastPass resulted in the theft of encrypted user vault backups, which contained sensitive credentials including cryptocurrency private keys and seed phrases. Over the subsequent years, attackers exploited weak or unchanged master passwords to decrypt these vaults offline, enabling the theft and laundering of more than $35 million in digital assets as recently as late 2025. Evidence from blockchain intelligence firm TRM Labs indicates that Russian cybercriminal actors were involved, with stolen funds traced to Russian exchanges such as Cryptex and Audia6. The breach led to significant regulatory action, including a £1.2 million fine by the UK Information Commissioner’s Office in December 2025 for inadequate security measures. The incident highlights the long-term risks associated with password manager breaches, especially when users do not update their master passwords, and underscores the need for robust password management and user education in the financial and technology sectors. All findings in this report are based on primary sources and verified dates, with technical evidence corroborated by multiple independent investigations.

Technical Information

The 2022 compromise of LastPass involved the theft of encrypted user vault backups, which are files containing all stored credentials, including sensitive information such as cryptocurrency wallet private keys and seed phrases. The security of these vaults depended entirely on the strength of each user’s master password. Attackers did not need to break the encryption algorithm itself; instead, they performed offline brute-force attacks against the stolen vaults, systematically guessing master passwords until successful decryption was achieved. This method allowed attackers to work undetected and at their own pace, targeting users who had weak or unchanged master passwords.

TRM Labs conducted extensive on-chain analysis, revealing that the attackers grouped their thefts into campaign-level clusters. This clustering allowed analysts to link large portions of the stolen funds to a withdrawal pipeline that matched in both timing and value. The laundering process involved converting stolen assets to Bitcoin and using Wasabi Wallet, a privacy-focused wallet that implements CoinJoin mixing techniques to obfuscate transaction origins. Despite these obfuscation attempts, TRM Labs was able to demix the activity, uncovering patterns such as clustered withdrawals and peeling chains that funneled mixed Bitcoin into Russian exchanges.

The laundering pipeline consistently used Russian exchanges Cryptex and Audia6 as off-ramps. Cryptex was sanctioned by the US Treasury in September 2024 for its role in laundering over $51.2 million in illicit funds, including ransomware proceeds. The attackers also used Cryptomixer.io, another cryptocurrency mixing service, to further complicate tracing efforts.

Attribution to Russian cybercriminal actors is based on several technical and circumstantial factors. On-chain evidence shows repeated interaction with Russia-associated infrastructure, continuity of control across pre- and post-mix activity, and the use of high-risk Russian exchanges as off-ramps. While there is no direct technical artifact such as malware code overlap, the operational patterns and infrastructure reuse provide medium confidence in the attribution.

The breach had a direct and ongoing impact on the cryptocurrency sector, with over $35 million in digital assets stolen and laundered through Russian exchanges. The attack demonstrates the persistent risk posed by stolen encrypted vaults, especially when users do not update weak master passwords. Regulatory scrutiny increased as a result, with significant fines and public advisories highlighting the need for robust password management and user education.

The technical methods used by the attackers can be mapped to the MITRE ATT&CK framework as follows: T1555.003 (Credentials from Password Managers) for the initial theft of encrypted vaults, T1110.002 (Brute Force: Password Guessing) for offline brute-forcing of master passwords, T1036 (Masquerading) for the use of mixers and exchanges to obfuscate fund origins, T1041 (Exfiltration Over C2 Channel) for the exfiltration of decrypted credentials and crypto keys, and T1496 (Resource Hijacking) for the theft and laundering of cryptocurrency assets.

Affected Versions & Timeline

The breach affected all LastPass users whose encrypted vault backups were stolen in 2022. The impact was not limited to a specific version of the product, as the attack targeted the encrypted vaults themselves rather than a particular software release. The timeline of verified events is as follows: In 2022, the LastPass breach occurred and encrypted vaults were stolen. Between late 2024 and early 2025, $28 million in cryptocurrency was laundered via Wasabi Wallet. In September 2025, an additional $7 million theft wave was detected, with funds traced to Russian exchanges in October 2025. In December 2025, the UK Information Commissioner’s Office fined LastPass £1.2 million for failing to implement adequate security measures, affecting up to 1.6 million UK customers.

Threat Activity

The threat actors behind the LastPass breach demonstrated a high level of operational discipline and adaptability. After obtaining the encrypted vaults in 2022, they focused on offline brute-force attacks against weak master passwords, allowing them to decrypt vaults and access stored credentials over a multi-year period. The attackers prioritized vaults that contained cryptocurrency wallet keys and seed phrases, enabling them to drain digital assets from victims’ wallets.

The laundering process was sophisticated, involving the conversion of stolen assets to Bitcoin and the use of privacy-enhancing tools such as Wasabi Wallet and Cryptomixer.io. Despite the use of CoinJoin mixing techniques, which are designed to make tracing transactions more difficult, TRM Labs was able to demix the activity and trace the flow of funds to Russian exchanges Cryptex and Audia6. These exchanges have a documented history of facilitating illicit activity and were used as off-ramps to cash out the stolen assets.

The attackers adapted quickly to changes in the threat landscape, shifting infrastructure when services were sanctioned and continuing to exploit unrotated or weak master passwords years after the initial breach. The use of Russian exchanges as liquidity hubs for global cybercrime operations underscores the ongoing challenge of disrupting these illicit financial networks.

Mitigation & Workarounds

The most effective mitigation for users affected by the LastPass breach is to immediately change their master password to a strong, unique value. Users who stored cryptocurrency wallet keys or recovery phrases in LastPass prior to 2022 should move their crypto assets to new wallets with new keys, as the old credentials may have been compromised. It is critical to monitor for any unexpected or unauthorized cryptocurrency transactions and report suspicious activity to wallet providers. Keeping all applications and devices updated, and using security tools that monitor for suspicious account or wallet activity, can help reduce the risk of further compromise.

For organizations, it is essential to educate users about the importance of strong master passwords and regular password rotation. Implementing additional layers of security, such as multi-factor authentication (MFA), can provide further protection against unauthorized access. Regular audits of password manager usage and stored credentials should be conducted to identify and remediate potential risks.

References

The Hacker News, December 25, 2025: https://thehackernews.com/2025/12/lastpass-2022-breach-led-to-years-long.html

CyberInsider, December 25, 2025: https://cyberinsider.com/stolen-crypto-from-2022-lastpass-breach-enables-multi-year-theft-campaign/

UK Information Commissioner’s Office fine referenced in both above sources, December 2025

About Rescana

Rescana provides a third-party risk management (TPRM) platform that enables organizations to continuously assess and monitor the security posture of their vendors and partners. Our platform supports the identification of supply chain risks, facilitates evidence-based risk analysis, and helps organizations implement effective controls to mitigate the impact of breaches involving third-party services. For questions or further information, please contact us at ops@rescana.com.