U.S. authorities have seized over $23 million in cryptocurrency linked to the theft of $150 million from a Ripple crypto pockets in January 2024. Investigators consider hackers who breached LastPass in 2022 had been behind the assault.
Regardless of the menace actors’ efforts, legislation enforcement brokers traced $23,604,815.09 of the stolen digital property between June 2024 and February 2025 to the next cryptocurrency exchanges: OKX, Payward Interactive, Inc. (dba Kraken), WhiteBIT, AscendEX Expertise SRL, Ftrader Ltd (dba FixedFloat), SwapSpace LLC, and Rabbit Finance LLC (dba CoinRabbit).
A forfeiture criticism unsealed by the U.S. Justice Division yesterday and first noticed by crypto fraud investigator ZachXBT reveals that U.S. Secret Service brokers who interviewed the sufferer consider the attackers may have solely stolen the cryptocurrency utilizing non-public keys extracted by cracking the sufferer’s password vault stolen in a 2022 breach of a web based password supervisor.
They discovered that the stolen information and passwords saved in a number of victims’ password supervisor accounts had been utilized by attackers to entry “their digital accounts and steal data, cryptocurrency, and different information.”
In addition they found no proof that the sufferer’s gadgets had been hacked, which factors to the decryption of the stolen on-line password supervisor information as the one approach the attackers may have obtained the keys wanted to compromise the sufferer’s crypto pockets.
“The dimensions of a theft and fast dissipation of funds would have required the efforts of a number of malicious actors, and was according to the web password supervisor breaches and assault on different victims whose cryptocurrency was stolen,” the criticism reads.
“For these causes, legislation enforcement brokers consider the cryptocurrency stolen from Sufferer was dedicated by the identical attackers who carried out the assault on the web password supervisor, and cryptocurrency thefts from different equally located victims.”
Crypto theft linked to LastPass hacks
Whereas the investigators did not title the on-line password supervisor, the criticism says that the platform was hit by “two main information breaches” in August 2022 and November 2022.
This timeline aligns with safety breaches disclosed by LastPass three years in the past when the corporate mentioned that attackers stole supply code and proprietary technical data, in addition to buyer vault information, after breaching its cloud storage.
Since then, a number of safety consultants have shared that they consider the LastPass hackers have cracked a number of the stolen vault information and used the extracted non-public keys and credentials in main cryptocurrency heists.
Though the investigators did not determine the sufferer, the small print match the hack and the theft of $150 million in cryptocurrency from Ripple co-founder and government chairman Chris Larsen, which was disclosed on January 31, 2024.
ZachXBT first linked the $23 million in cryptocurrency seized this week and the hack of Larsen’s XRP pockets.
“A forfeiture criticism filed yesterday by US legislation enforcement revealed the trigger for the ~$150M (283M XRP) hack of Ripple co-founder, Chris Larsen’s pockets in Jan 2024 was the results of storing non-public keys in LastPass (password supervisor which was hacked in 2022),” he mentioned immediately in a Telegram message.
A Ripple spokesperson was not instantly out there when BleepingComputer reached out for remark earlier immediately.
Replace March 07, 14:40 EST: LastPass despatched the next assertion after publishing time:
Since we initially disclosed this incident again in 2022, LastPass has labored in shut cooperation with a number of representatives from legislation enforcement. To this point, our legislation enforcement companions haven’t made us conscious of any conclusive proof that connects any crypto thefts to our incident.
