Official announcements from LastPass or press releases

LastPass Breach Fallout: $5.4M in Crypto Stolen from 40+ Wallets

Dec 17, 2024, 06:10 AM

A threat actor linked to the 2022 LastPass data breach has stolen approximately $5.4 million in cryptocurrency from over 40 victim addresses, according to blockchain investigator ZachXBT. The attackers exploited sensitive data, including private keys stored in the compromised LastPass vaults, to drain funds through ETH-BTC swaps on instant exchanges. This incident is part of a series of attacks following the initial breach, with previous losses amounting to $4.4 million in October 2023 and $6.2 million in February 2024. The stolen funds were funneled through various exchanges, with one example showing 27 ETH (~$110K) deposited to FixedFloat. ZachXBT advises users who have used LastPass to migrate their funds to fresh wallets to prevent further theft.