Russian Networks Linked to Laundering of LastPass Breach's $35M in Stolen Crypto

Following the 2022 LastPass data breach, blockchain firm TRM Labs has tied over $35 million in stolen cryptocurrency to Russian cybercriminals, detailing sophisticated laundering via mixers and exchanges persisting into late 2025.

Blockchain intelligence firm TRM Labs has deepened its analysis of the 2022 LastPass breach—previously reported for enabling prolonged crypto thefts—revealing direct ties to Russian cybercriminal networks. The password manager hack exposed user vaults, allowing drainings that continued into late 2025.

Attackers obscured the trail using privacy tools: converting assets to Bitcoin via instant swaps, then mixing through Wasabi Wallet and CoinJoin. TRM Labs de-anonymized these using behavioral analysis, tracking wallet software patterns and digital footprints.

Funds ultimately flowed to Russian platforms, including sanctioned exchange Cryptex and Audi6 ($7M deposited). A 'consistent on-chain signature' indicates a single Russia-based group. This underscores Russian exchanges' role in illicit finance, evading global enforcement amid persistent state-linked threats.

Awọn iroyin ti o ni ibatan

Illustration of North Korean hackers in a cyber command center stealing a record $2 billion in cryptocurrency from global exchanges like Bybit.
Àwòrán tí AI ṣe

North Korea steals record $2 billion in cryptocurrency in 2025

Ti AI ṣe iroyin Àwòrán tí AI ṣe

North Korean hackers stole a record $2.02 billion in cryptocurrency in 2025, according to a new Chainalysis report, surpassing the previous year's haul by 51 percent and bringing their total to $6.75 billion. The thefts, which accounted for 60 percent of the global total of $3.4 billion stolen, were driven by fewer but larger attacks, including a $1.5 billion breach of the Dubai-based Bybit exchange in February. Experts attribute the success to sophisticated tactics like embedding IT workers in crypto firms and impersonating recruiters.

A 2022 data breach at password manager LastPass has resulted in prolonged cryptocurrency thefts, according to blockchain intelligence firm TRM Labs. The incident involved stolen user vaults that facilitated around $35 million in losses extending into 2025.

Ti AI ṣe iroyin

A cryptocurrency investor lost over $282 million in Bitcoin and Litecoin after scammers impersonated Trezor support to steal a recovery seed phrase. The theft, revealed on January 16, 2026, by investigator ZachXBT, involved 1,459 Bitcoin and 2.05 million Litecoin stolen on January 10. The attacker laundered funds through Thorchain and converted them to Monero, causing the privacy coin's price to surge 36%.

North Korea's hacking group Lazarus is suspected of being behind a recent breach of around 45 billion won ($30.6 million) in cryptocurrency from South Korea's largest exchange Upbit. Authorities plan an on-site investigation, while Upbit operator Dunamu will cover the full loss with its own assets. The incident resembles a 2019 hack at Upbit attributed to the same group.

Ti AI ṣe iroyin

Iran's Islamic Revolutionary Guard Corps shifted about $1 billion in cryptocurrency via two UK-registered exchanges from 2023 to 2025, bypassing Western sanctions. Blockchain firm TRM Labs revealed the transactions, which mostly involved Tether's USDT on the Tron network. The activity highlights cryptocurrency's role in evading financial restrictions.

Building on a Chainalysis report documenting $2.02 billion in 2025 cryptocurrency thefts by North Korean hackers, a U.S. State Department official told a U.N. meeting that Pyongyang likely stole more than $2 billion last year to support its nuclear and missile programs. The figure aligns with Multilateral Sanctions Monitoring Team findings of over $1.6 billion stolen from January to September 2025.

Ti AI ṣe iroyin

Physical assaults known as wrench attacks against cryptocurrency holders are increasing in number and severity, according to recent analyses. These incidents correlate with fluctuations in crypto market values, prompting calls for enhanced personal security measures. While overall risks to individual holders may be decreasing, the trend highlights vulnerabilities in self-custody practices.

 

 

 

Ojú-ìwé yìí nlo kuki

A nlo kuki fun itupalẹ lati mu ilọsiwaju wa. Ka ìlànà àṣírí wa fun alaye siwaju sii.
Kọ