← AVOID.NET
Entity Graph
Browse extracted entities, relationships, and potential duplicates.
Total entities
31,864
Relationships
34,562
Potential duplicates
4
Filter by kind
Potential Duplicates
Entities with similar names that may refer to the same thing. Use the merge API to combine them.
substring match↯ TRM Labs publishes report tracing over $35 million through Wasabi Wallet laundering pipeline, with on-chain indicators suggesting Russian cybercriminal involvement. Theft activity traced as recently as October 2025.↔↯ TRM Labs publishes comprehensive on-chain investigation concluding total cryptocurrency losses attributable to the LastPass breach exceed $438 million, with laundering traced to Russian exchanges Cryptex (OFAC-sanctioned) and Audi6 via Wasabi Wallet CoinJoin.b0ed357d / 0b4c59a8
substring match↯ UK Information Commissioner's Office issues £1,228,283 penalty to LastPass UK Limited for GDPR violations stemming from the 2022 breach.↔↯ UK ICO issues £1.23 million monetary penalty against LastPass UK Ltd for UK GDPR violations arising from the 2022 breach, citing inadequate technical security measures affecting 1.6 million UK users.52ae9105 / da76b1ee
substring match↯ Federal prosecutors in Northern California seize $23,604,815 in cryptocurrency via civil forfeiture complaint, explicitly linking the Larsen theft to the 2022 LastPass breach.↔↯ US federal prosecutors in the Northern District of California seize approximately $23–24 million in cryptocurrency linked to the Larsen XRP theft. DOJ forfeiture complaint unsealed confirms LastPass breach as root cause.3fd8a26c / d5f433b6
substring match↯ Over $6.2 million stolen from additional LastPass users in a new theft wave, tracked by ZachXBT.↔↯ ZachXBT is first to publicly attribute the Larsen XRP theft to the LastPass breach via Telegram. ZachXBT documents a separate $6.2 million theft wave in February 2024.12d7b3a9 / 1b629beb
Merge instructions
curl -X POST /api/graph/merge \
-H "Authorization: Bearer $ADMIN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"keepId": "<entity-to-keep>", "mergeId": "<entity-to-remove>"}'Entities (event)
↯bad1f868
Independent Security Evaluators (ISE) publishes 'Ethercombing: Finding Secrets in Popular Places,' publicly documenting the Blockchain Bandit's methods, scale, and primary wallet address for the first time. WIRED publishes concurrent coverage by Andy Greenberg.(2019-04-23:blockchain-bandit)event
↯3371a2af
Blockchain Bandit's active exploitation campaign largely ceases; wallets enter dormancy.(2018-12-31:blockchain-bandit)event
↯10146c83
Blockchain Bandit's primary accumulation address (0x957cd4ff9b3894fc78b5134a8dc72b032ffbc464) holds 37,926 ETH, valued at approximately $54.3 million at prevailing Ethereum prices.(2018-01-13:blockchain-bandit)event
↯cd5ecb8a
Blockchain Bandit activity peaks; actor begins systematically draining Ethereum wallets derived from 732 compromised private keys across 49,060 transactions.(2016-01-01:blockchain-bandit)event
↯70c4df5b
Earliest alleged Blockchain Bandit wallet exploitation activity begins, targeting Ethereum addresses generated with weak private keys.(2015-01-01:blockchain-bandit)event
↯7d5508d8
Multiple crypto news outlets (The Block, CoinDesk, Cryptopolitan, Brave New Coin) report on the exploit. ZachXBT's Chainabuse report on attacker Solana addresses published.(2024-11-04:metawin)event
↯9619aa8d
ZachXBT begins on-chain tracing in collaboration with Metawin CEO. Over 115 attacker-linked wallet addresses identified across Ethereum and Solana. Stolen funds traced to KuCoin and a nested HitBTC service.(2024-11-03:metawin)event
↯bdb120fc
MetaWin Limited registered in the UK (company number 15072116) with Raman Dandyan listed as beneficial owner (75%+). Exact incorporation date approximated from available records.(2023-01-01:metawin)event
↯b0ed357d
TRM Labs publishes report tracing over $35 million through Wasabi Wallet laundering pipeline, with on-chain indicators suggesting Russian cybercriminal involvement. Theft activity traced as recently as October 2025.(2025-12-01:lastpass-threat-actor)event
↯52ae9105
UK Information Commissioner's Office issues £1,228,283 penalty to LastPass UK Limited for GDPR violations stemming from the 2022 breach.(2025-11-20:lastpass-threat-actor)event
↯3fd8a26c
Federal prosecutors in Northern California seize $23,604,815 in cryptocurrency via civil forfeiture complaint, explicitly linking the Larsen theft to the 2022 LastPass breach.(2025-03-06:lastpass-threat-actor)event
↯e61679ca
ZachXBT reports $5.36 million drained from over 40 victim addresses, with funds swapped to ETH and converted to Bitcoin via instant exchange services.(2024-12-18:lastpass-threat-actor)event
↯094e3856
OFAC sanctions Cryptex, the Russia-based exchange used as an off-ramp for LastPass-linked stolen funds.(2024-09-26:lastpass-threat-actor)event
↯a933777c
Estimated total crypto losses linked to LastPass breach exceed $250 million, per researcher Taylor Monahan.(2024-05-01:lastpass-threat-actor)event
↯12d7b3a9
Over $6.2 million stolen from additional LastPass users in a new theft wave, tracked by ZachXBT.(2024-02-01:lastpass-threat-actor)event
↯e199e00a
$150 million in XRP stolen from personal cryptocurrency accounts of Ripple co-founder Chris Larsen, later attributed to LastPass breach.(2024-01-30:lastpass-threat-actor)event
↯893a0536
Approximately $4.4 million drained from 25+ victim addresses in a single day, reported by ZachXBT.(2023-10-25:lastpass-threat-actor)event
↯6766ba5a
Taylor Monahan concludes that nearly all theft victims had stored cryptocurrency seed phrases in LastPass, publicly linking the theft campaign to the 2022 breach.(2023-08-28:lastpass-threat-actor)event
↯302cfdaa
Taylor Monahan (MetaMask) begins tracking unusual cryptocurrency theft pattern affecting crypto-native individuals, later linked to LastPass.(2023-03-01:lastpass-threat-actor)event
↯222e0311
LastPass publicly discloses that encrypted customer password vaults and associated metadata were stolen in the August–November breach.(2022-12-22:lastpass-threat-actor)event
↯316fbd68
LastPass detects and terminates threat actor's persistent cloud storage access, which had lasted approximately 75 days.(2022-10-26:lastpass-threat-actor)event
↯7832f13c
Second intrusion begins: threat actor exploits unpatched Plex CVE-2020-5741 on DevOps engineer's home computer, installing keylogger malware to capture master password and gain access to corporate vault.(2022-08-12:lastpass-threat-actor)event
↯b07c0365
Threat actor compromises LastPass developer laptop, exfiltrating 14 source code repositories, technical documentation, and an encrypted AWS S3 key.(2022-08-08:lastpass-threat-actor)event
↯3a2946d0
Drift Protocol compromised in elaborate social engineering operation; North Korean proxies met Drift employees in person at conferences and made deposits over $1M to appear as legitimate partners before exploiting the protocol for $285M(2026-04-01:dprk)event
↯7e210c12
OFAC sanctions six individuals and two entities for DPRK IT worker fraud schemes; designates 21 cryptocurrency addresses across multiple blockchains(2026-03-12:dprk)event
↯87839fa6
North Korea-linked hackers confirmed to have stolen over $2.02 billion in 2025 — a 51% year-over-year increase — representing the worst annual total on record(2025-12-01:dprk)event
↯f364d5df
Lazarus Group alleged to have laundered 83% of stolen Bybit ETH (~$1B) through THORChain, converting to Bitcoin distributed across 6,954 wallets; THORChain earns ~$5.5M in fees. Several THORChain developers resign after community votes against blocking laundering(2025-03-05:dprk)event
↯f2e0cb84
FBI issues IC3 PSA250226 attributing Bybit hack to North Korean TraderTraitor; releases 51 Ethereum addresses used in laundering. ZachXBT independently identifies Lazarus Group via wallet linkage and receives $50K Arkham bounty(2025-02-26:dprk)event
↯00dd7ea1
Bybit exchange hacked; ~499,000 ETH (~$1.5B) stolen via Safe wallet supply-chain attack. TraderTraitor actors inject malicious code targeting Bybit-specific transactions(2025-02-21:dprk)event
↯df89b1fd
United States, Japan, and South Korea issue first-ever trilateral joint statement on DPRK cryptocurrency theft, citing over $659M stolen in 2024(2025-01-14:dprk)event
↯6fe1ce31
WazirX (India) loses $234.9M; Lazarus Group manipulates multisig smart contract during signing session. ZachXBT traces test transactions to July 10 and notes Tornado Cash funding of attacker addresses(2024-07-18:dprk)event
↯3ce07a06
DMM Bitcoin (Japan) loses $308M in Bitcoin via supply-chain attack traced to TraderTraitor operative posing as recruiter to compromise Ginco developer. FBI and Japan NPA jointly attribute the attack(2024-05-31:dprk)event
↯787a9a07
OFAC sanctions Sinbad.io virtual currency mixer for laundering Lazarus Group funds from Ronin Bridge and Horizon Bridge heists(2023-11-01:dprk)event
↯39fe267a
Atomic Wallet breached; over $100M stolen from users. Blockchain analytics firms attribute attack to Lazarus Group(2023-06-01:dprk)event
↯3d04e86d
North Korean actors use RAILGUN protocol to launder over $60M in ETH from Harmony Horizon Bridge hack; funds also routed through Tornado Cash(2023-01-13:dprk)event
↯28c49997
Harmony Horizon Bridge hacked; $100M in crypto assets stolen. FBI later confirms Lazarus Group responsible(2022-06-24:dprk)event
↯26b7994a
OFAC issues first-ever sanctions on a virtual currency mixer — Blender.io — for processing over $20.5M in Ronin hack proceeds(2022-05-06:dprk)event
↯00517f44
CISA, FBI, and U.S. Treasury issue joint advisory AA22-108A on TraderTraitor, warning blockchain companies of DPRK targeting(2022-04-22:dprk)event
↯42bf7132
U.S. Treasury (OFAC) sanctions Lazarus Group Ethereum wallet linked to Ronin Bridge hack; FBI and OFAC jointly attribute attack to DPRK(2022-04-14:dprk)event
↯fc301dfa
Ronin Network (Axie Infinity) bridge hacked; 173,600 ETH and 25.5M USDC stolen (~$625M). Attack later attributed to Lazarus Group by U.S. Treasury(2022-03-23:dprk)event
↯53abf665
Lazarus Group designated on OFAC Specially Designated Nationals List under North Korea Sanctions Regulations(2018-01-01:dprk)event
↯1c649880
US court grants preliminary approval to $24.45 million class action settlement covering LastPass breach victims, with a $16.25 million sub-fund for cryptocurrency loss claims.(2026-02-02:lastpass)event
↯0b4c59a8
TRM Labs publishes comprehensive on-chain investigation concluding total cryptocurrency losses attributable to the LastPass breach exceed $438 million, with laundering traced to Russian exchanges Cryptex (OFAC-sanctioned) and Audi6 via Wasabi Wallet CoinJoin.(2025-12-01:lastpass)event
↯da76b1ee
UK ICO issues £1.23 million monetary penalty against LastPass UK Ltd for UK GDPR violations arising from the 2022 breach, citing inadequate technical security measures affecting 1.6 million UK users.(2025-11-20:lastpass)event
↯7d572ba6
TRM Labs identifies a new September 2025 wave of approximately $7 million in additional thefts laundered through Wasabi Wallet to Russian exchange Audi6.(2025-09-01:lastpass)event
↯d5f433b6
US federal prosecutors in the Northern District of California seize approximately $23–24 million in cryptocurrency linked to the Larsen XRP theft. DOJ forfeiture complaint unsealed confirms LastPass breach as root cause.(2025-03-06:lastpass)event
↯928086ec
ZachXBT reports a separate theft of $12.38 million from more than 100 wallet addresses (Bitcoin, Ethereum, Avalanche) within hours.(2024-12-17:lastpass)event
↯e4e0a6df
ZachXBT reports $5.4 million stolen from over 40 victim addresses on December 16–17; funds swapped for ETH then converted to Bitcoin via instant exchanges.(2024-12-16:lastpass)event
↯b9cea5a8
Law enforcement begins tracing $23.6 million of Larsen's stolen XRP across OKX, Kraken, WhiteBIT, AscendEX, FixedFloat, SwapSpace, and CoinRabbit.(2024-06-01:lastpass)event
↯1b629beb
ZachXBT is first to publicly attribute the Larsen XRP theft to the LastPass breach via Telegram. ZachXBT documents a separate $6.2 million theft wave in February 2024.(2024-02-01:lastpass)event
Data refreshes within about 10 minutes · All metrics derived from Supabase