US Authorities Seize 3M in Crypto from 50M Ripple Hack Linked to LastPass Breach

In a significant cybersecurity development, U.S. authorities have successfully seized over $23 million in cryptocurrency that was tied to a massive hack involving Ripple, valued at $150 million. This breach is believed to have been orchestrated by hackers who leveraged data stolen during the infamous 2022 LastPass security breach. The incident not only highlights the continuing risk of cybercrime but also shines a light on how attackers are increasingly targeting encrypted vaults and crypto wallets. Here’s an overview of the latest findings and the events that have unfolded since the breach.

Events

Authorities have seized a total of $23,604,815.09 in stolen cryptocurrency, which was funneled through several major cryptocurrency exchanges, including OKX, Kraken, WhiteBIT, AscendEX, FixedFloat, SwapSpace, and CoinRabbit. The funds were tracked from June 2024 to February 2025, leading investigators to believe that the hackers took advantage of vulnerabilities in the victims’ password vaults.

Security researcher ZachXBT has identified Ripple co-founder Chris Larsen as the victim of this multi-million dollar heist. Prior findings indicated that the cybercriminals may have cracked master passwords using data stolen from the 2022 LastPass breach. According to a complaint filed by the U.S. Department of Justice (DoJ), hackers could have accessed private keys and other sensitive information from the password manager, enabling them to access and steal cryptocurrency from the victim’s wallet.

The stolen data, including encrypted passwords, was taken during two major breaches of a well-known online password manager in August and November of 2022. The exact name of the company affected has not been disclosed, but investigators have pointed to LastPass as the likely source of the leak. Law enforcement is working closely with the FBI, which has been investigating these breaches. The investigation also revealed that attackers did not hack the victim’s device directly but instead decrypted stolen vault data to facilitate the crypto theft.

Additionally, investigators noted that the attack was not random or opportunistic but appeared to be part of a larger, coordinated effort by cybercriminals, using a series of drop accounts across multiple exchanges to launder the stolen funds. Although LastPass denies any direct connection between their breach and the theft of crypto funds, many victims and researchers suggest otherwise, citing how many had stored their crypto seed phrases within the “Secure Notes” feature on LastPass before the breach.

What Undercode Says:

The ongoing scrutiny surrounding the LastPass breach and its role in facilitating major cryptocurrency thefts raises several important questions regarding cybersecurity protocols, especially in the crypto and password management sectors. From an analytical standpoint, it’s evident that data breaches involving password vaults and seed phrases are becoming an increasingly effective means for cybercriminals to target high-value individuals and organizations.

The revelation that attackers were able to extract master passwords from LastPass’ vault, and use them to access sensitive crypto wallets, exposes a critical vulnerability in how many users store and safeguard their cryptocurrency keys. It’s a wake-up call for those who continue to rely on password managers without recognizing the inherent risks associated with storing highly sensitive information in centralized locations.

The scale of the hack involving Ripple co-founder Chris Larsen, one of the prominent figures in the cryptocurrency industry, further demonstrates how the industry remains a top target for cybercriminals. The fact that the stolen crypto was spread across multiple exchanges highlights the sophistication of the operation, as well as the extent to which crypto criminals are now operating in a more organized and strategic manner.

Furthermore, this case underscores the pressing need for more stringent security measures by both password management companies and cryptocurrency platforms. While LastPass claims they have not received any conclusive evidence connecting their breach to the stolen crypto, the pattern of thefts and the correlation with LastPass’ earlier vulnerabilities cannot be ignored.

Security experts like Nick Bax and Taylor Monahan have raised concerns about the lack of warnings to users about the risks of storing cryptocurrency seed phrases in “Secure Notes,” a feature within LastPass that many believed to be secure. This failure to alert users to potential vulnerabilities can be seen as a major oversight, especially given the increasing sophistication of cyber attacks.

The continued use of decentralized platforms for laundering stolen funds points to an urgent need for tighter regulations and better tracking mechanisms within the cryptocurrency space. As exchanges are increasingly being used to funnel stolen assets, law enforcement agencies will need to ramp up their cooperation with these platforms to ensure that illicit funds are flagged and seized before they can be cashed out or moved.

Lastly, the involvement of the FBI and their ongoing investigations into the breach of a widely-used password manager reflects the importance of collaboration across various security domains. With online breaches growing more common, law enforcement’s efforts to track stolen crypto and identify perpetrators may be crucial in curbing future attacks.

Fact Checker Results:

Corroborated by Authorities: The seizure of $23M in stolen crypto and the connection to the 2022 LastPass breach has been confirmed by law enforcement, with funds traced to multiple exchanges.
Possible Correlation with LastPass: While LastPass denies a direct link to the crypto thefts, evidence points to their system being used as a vector for the breach.
Security Concerns Validated: The consistent theme of stolen seed phrases being stored in password managers and subsequently targeted by hackers supports the broader concerns regarding password vault security.

References:

Reported By: https://securityaffairs.com/175156/cyber-crime/feds-seized-23-million-in-crypto-stolen-using-keys-from-lastpass-breaches.html
Extra Source Hub:
https://www.facebook.com
Wikipedia: https://www.wikipedia.org
Undercode AI