Stolen LastPass backups enable crypto theft through 2025

Stolen vault backups from the 2022 LastPass breach are still being cracked, permitting crypto theft as late as 2025, according to TRM Labs. The firm notes that encrypted backups of roughly 30 million vaults containing sensitive credentials, including crypto keys, were stolen in 2022 and could be decrypted using weak master passwords, creating a multi-year risk. Wallet drains continued through 2024–2025, with stolen funds traced through mixers to high-risk Russian exchanges.

TRM Labs traced over $28 million in crypto stolen via the LastPass breach, converted to Bitcoin, and laundered through Wasabi Wallet in 2024–2025, with activity linked to Russia-based operators. The findings point to diminishing effectiveness of mixing and ongoing laundering infrastructure aligned with a Russian cybercrime ecosystem across multiple phases. Earlier this month, the U.K.

ICO fined the password manager £1.2m for inadequate security measures that failed to prevent the breach, underscoring continuing regulatory attention. According to TRM Labs’ report, while definitive attribution cannot yet be confirmed, signals suggest a central role for Russian cybercrime infrastructure in monetising large-scale hacks.