LastPass hackers drained $12.4m ETH from 100+ wallets: ZachXBT

The 2022 LastPass data breach allowed threat actors to steal $12.38 million from users with a new attack.

According to blockchain detective ZachXBT, LastPass hackers stole millions of Ethereum (ETH) from more than 100 wallet addresses between December 16 and December 17. Criminals quickly switched ill-gotten wealth from ETH to Bitcoin (BTC) using multiple instant transactions. stock markets. You can find a list of affected addresses here.

LastPass is a password management service for securing cryptocurrency wallets. The initiative suffered two attacks in 2022, one in August and the other in October; This led to unauthorized access to customer keys, API tokens, multi-factor authentication seeds, and other sensitive security information.

In January 2023, users filed a class-action lawsuit against LastPass. The complaint alleged that the provider failed to protect user data and adopted lax security protocols.

Turbulent times continued for the company as bad actors used stolen data to carry out staged crypto heists. According to crypto.news, a cryptocurrency owner accused LastPass of a $50,000 theft in April 2023. By late October, 25 victims had lost $4.4 million to those who drained their wallets. LastPass has once again come under fire for the breach.

The latest incident has raised questions about future LastPass-related attacks as criminals continue to exploit stolen information in 2022. This incident also reminded the larger crypto community of current security threats.

MetaMask developer Taylor Manohan urged users to move their funds to new wallets if they have used LastPass before. A white hat coalition called the Security Alliance or SEAL ORG also informed users that their crypto assets could be at risk if action is not taken.

⚠️ Be aware that if you stored your private keys or seed phrases in LastPass before 2023, your funds may be at risk. TODAY we saw more than 15 cases of potential attacks related to LastPass

Move your assets before hackers move them for you. Read on for more information🧵

— Security Alliance (@_SEAL_Org) December 16, 2024