LastPass 2022 Breach Led to Years-Long Cryptocurrency Thefts, TRM Labs Finds

TRM Labs has found that the encrypted vault backups stolen in the 2022 LastPass breach were used to crack weak master passwords and drain cryptocurrency assets for years, with activity continuing into late 2025. According to TRM Labs, the findings point to involvement by Russian cybercriminal actors, including an instance where funds reached a Russian exchange as recently as October.

The firm notes that even when mixers were employed, patterns such as repeated interaction with Russia-associated infrastructure and use of high‑risk Russian exchanges served as indicators of attribution. The investigation highlights that more than $35 million in siphoned assets have been traced, with about $28 million converted to Bitcoin and laundered via Wasabi Wallet between late 2024 and early 2025, and a further $7 million linked to a later wave in September 2025.

The stolen funds have been routed through Cryptomixer[.]io and off‑ramped via Cryptex and Audia6, two Russian exchanges, with Cryptex previously sanctioned by the US Treasury in September 2024 for illicit funds linked to ransomware. The ICO recently fined LastPass $1.6 million for failing to implement robust security measures surrounding the incident.