U.S. authorities have seized over $23 million in cryptocurrency linked to the theft of $150 million from a Ripple crypto pockets in January 2024. Investigators imagine hackers who breached LastPass in 2022 have been behind the assault.
Regardless of the risk actors’ efforts, regulation enforcement brokers traced $23,604,815.09 of the stolen digital property between June 2024 and February 2025 to the next cryptocurrency exchanges: OKX, Payward Interactive, Inc. (dba Kraken), WhiteBIT, AscendEX Expertise SRL, Ftrader Ltd (dba FixedFloat), SwapSpace LLC, and Rabbit Finance LLC (dba CoinRabbit).
A forfeiture complaint unsealed by the U.S. Justice Division yesterday and first noticed by crypto fraud investigator ZachXBT reveals that U.S. Secret Service brokers who interviewed the sufferer imagine the attackers might have solely stolen the cryptocurrency utilizing personal keys extracted by cracking the sufferer’s password vault stolen in a 2022 breach of an internet password manager.
They discovered that the stolen information and passwords saved in a number of victims’ password manager accounts have been utilized by attackers to entry “their digital accounts and steal info, cryptocurrency, and different information.”
Additionally they found no proof that the sufferer’s gadgets have been hacked, which factors to the decryption of the stolen on-line password manager information as the one manner the attackers might have obtained the keys wanted to compromise the sufferer’s crypto pockets.
“The dimensions of a theft and speedy dissipation of funds would have required the efforts of a number of malicious actors, and was in line with the web password manager breaches and assault on different victims whose cryptocurrency was stolen,” the criticism reads.
“For these causes, regulation enforcement brokers imagine the cryptocurrency stolen from Sufferer was dedicated by the identical attackers who carried out the assault on the web password manager, and cryptocurrency thefts from different equally located victims.”
Crypto theft linked to LastPass hacks
Whereas the investigators did not title the on-line password manager, the criticism says that the platform was hit by “two main information breaches” in August 2022 and November 2022.
This timeline aligns with safety breaches disclosed by LastPass three years in the past when the corporate stated that attackers stole source code and proprietary technical information, in addition to customer vault data, after breaching its cloud storage.
Since then, a number of safety consultants have shared that they imagine the LastPass hackers have cracked some of the stolen vault data and used the extracted personal keys and credentials in main cryptocurrency heists.
Despite the fact that the investigators did not establish the sufferer, the small print match the hack and the theft of $150 million in cryptocurrency from Ripple co-founder and government chairman Chris Larsen, which was disclosed on January 31, 2024.
ZachXBT first linked the $23 million in cryptocurrency seized this week and the hack of Larsen’s XRP pockets.
“A forfeiture criticism filed yesterday by US regulation enforcement revealed the trigger for the ~$150M (283M XRP) hack of Ripple co-founder, Chris Larsen’s pockets in Jan 2024 was the results of storing personal keys in LastPass (password manager which was hacked in 2022),” he stated at the moment in a Telegram message.
A Ripple spokesperson was not instantly obtainable when BleepingComputer reached out for remark earlier at the moment.
Replace March 07, 14:40 EST: LastPass despatched the next assertion after publishing time:
Since we initially disclosed this incident again in 2022, LastPass has labored in shut cooperation with a number of representatives from regulation enforcement. Thus far, our regulation enforcement companions haven’t made us conscious of any conclusive proof that connects any crypto thefts to our incident.
