LastPass
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3qt8AE…pEELSummary
LastPass is a widely used password manager that suffered a catastrophic two-stage data breach in 2022, resulting in the theft of encrypted customer password vaults containing cryptocurrency seed phrases and private keys. Threat actors subsequently cracked these vaults offline over the following years, draining crypto wallets in waves totaling more than $438 million across hundreds of victims by late 2025. The breach has led to a £1.2 million UK ICO regulatory fine, a $24.45 million US class action settlement, US federal seizures, and on-chain attribution by TRM Labs and blockchain researcher ZachXBT to Russian cybercriminal infrastructure.
Connected Entities
7 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- ZachXBT→mentioned with→Ethereum(70%)
- ZachXBT→mentioned with→Bitcoin(65%)
- ZachXBT→mentioned with→Kraken(60%)
- LastPass→mentioned with→FixedFloat(65%)
- LastPass→mentioned with→Ethereum(70%)
- LastPass→mentioned with→Kraken(65%)
- LastPass→mentioned with→Bitcoin(70%)
- LastPass→mentioned with→ZachXBT(70%)
- Chris Larsen→mentioned with→ZachXBT(70%)
- + 8 more
Timeline(17 events)
8 August 2022
First intrusion: attacker compromises LastPass developer's corporate laptop, exfiltrates source code and technical documentation over four days.
25 August 2022
LastPass CEO Karim Toubba publicly discloses the August breach, claiming no customer data was accessed.
8 September 2022
Second intrusion begins: attackers use stolen credentials from a senior DevOps engineer to access AWS S3 cloud storage.
22 September 2022
Second intrusion ends; attackers have exfiltrated a backup of customer vault data including encrypted seed phrases and private keys.
30 November 2022
LastPass publicly discloses the full scope of the breach, acknowledging that encrypted customer password vaults were stolen.
15 September 2023
KrebsOnSecurity publishes security researcher findings concluding that a series of six-figure crypto heists across dozens of victims resulted from cracked LastPass master passwords.
October 2023
ZachXBT documents approximately $4.4 million stolen from LastPass breach victims in October 2023.
30 January 2024
Ripple co-founder Chris Larsen has approximately 283 million XRP (~$150 million) stolen from wallets whose private keys were stored in LastPass.
February 2024
ZachXBT is first to publicly attribute the Larsen XRP theft to the LastPass breach via Telegram. ZachXBT documents a separate $6.2 million theft wave in February 2024.
June 2024
Law enforcement begins tracing $23.6 million of Larsen's stolen XRP across OKX, Kraken, WhiteBIT, AscendEX, FixedFloat, SwapSpace, and CoinRabbit.
16 December 2024
ZachXBT reports $5.4 million stolen from over 40 victim addresses on December 16–17; funds swapped for ETH then converted to Bitcoin via instant exchanges.
17 December 2024
ZachXBT reports a separate theft of $12.38 million from more than 100 wallet addresses (Bitcoin, Ethereum, Avalanche) within hours.
6 March 2025
US federal prosecutors in the Northern District of California seize approximately $23–24 million in cryptocurrency linked to the Larsen XRP theft. DOJ forfeiture complaint unsealed confirms LastPass breach as root cause.
September 2025
TRM Labs identifies a new September 2025 wave of approximately $7 million in additional thefts laundered through Wasabi Wallet to Russian exchange Audi6.
20 November 2025
UK ICO issues £1.23 million monetary penalty against LastPass UK Ltd for UK GDPR violations arising from the 2022 breach, citing inadequate technical security measures affecting 1.6 million UK users.
Decision Log
- hash: 5X17o8zjx7uu3gBdopLZLtgm72FTV5wfaKriq8wkspnU
This investigation is cryptographically anchored to the Solana blockchain (1 event).
model: claude-sonnet
generated: 5/4/2026, 4:04:56 PM
last updated: 8/29/2026, 1:35:55 AM
9 viewsavoid.net — verified advice for a post-truth world