TRM Labs report: The 2022 LastPass breach is still being exploited in late 2025, with more than $35M in crypto traced to related thefts.

Cybersecurity • Wallet Safety • Crypto Crime

LastPass 2022 Breach Still Fueling Crypto Thefts in 2025, TRM Labs Report Finds

A new analysis warns the LastPass breach wasn’t a one-time headline — it became a long-running pipeline for wallet drains, with traced losses now exceeding $35 million.

The crypto industry often treats breaches as isolated events: a hack happens, a headline hits, and the news cycle moves on. But a recent report by TRM Labs highlights a more uncomfortable reality: some compromises create a multi-year threat window — especially when stolen data can be used later to access self-custody wallets.

According to the report, the 2022 LastPass data breach has been linked to prolonged cryptocurrency thefts, with attackers using stolen vault data to drain assets as recently as late 2025. TRM Labs says the total traced amount of stolen crypto connected to the breach is now over $35 million.

Big takeaway: A password manager breach can become a delayed “wallet drain” event — because encrypted vaults can be cracked later, and once seed phrases or private keys are exposed, crypto theft can be irreversible.

What TRM Labs Says Happened

TRM Labs’ analysis focuses on the long-tail exploitation of compromised vault data. The key point is that attackers don’t always need immediate access to your accounts the day a breach is revealed. Instead, they can:

• store encrypted vaults and attempt to decrypt them over time,
• target high-value victims selectively (crypto holders, founders, traders),
• use recovered secrets (seed phrases, private keys, exchange credentials) to drain assets later,
• move funds across chains and services to reduce traceability.

This helps explain why the thefts tied to the breach appear to continue: the attacker’s “work” can happen quietly and gradually, with new decryption successes unlocking new victims.

Why Vault Data Is So Dangerous for Crypto Users

Many crypto users rely on password managers for convenience and security — storing exchange passwords, API keys, 2FA backup codes, and sometimes even “critical secrets” like recovery phrases. The risk is straightforward: if a seed phrase or private key ends up exposed, it can grant full control of a wallet.

Seed phrases are not like passwords

If your email password is stolen, you can reset it. If your wallet seed phrase is stolen, there is no “reset” button. The only effective response is to move funds to a new wallet created from a fresh seed phrase — ideally generated offline.

Rule of thumb: Treat seed phrases like physical gold bars — you don’t store them in a cloud note or a screenshot. The more copies that exist, the higher the risk.

A Simple Timeline of the Long-Tail Threat

2022 LastPass breach disclosed; data including vault information is exposed.

2023–2024 Attackers continue decrypting and exploiting recovered vault contents.

2025 TRM Labs links ongoing wallet drains to the breach; activity continues into late 2025.

Now Victims face the same harsh reality: once funds move, recovery becomes difficult and often impossible.

How Wallet Drains Usually Play Out

Crypto theft linked to compromised secrets often follows a predictable pattern:

• Account discovery: attacker identifies a wallet address or exchange account tied to the victim.
• Access step: attacker uses recovered credentials or seed phrase to sign transactions.
• Fast exit: funds are moved quickly into new addresses, sometimes bridged across chains.
• Obfuscation: funds may pass through mixers, swap routes, or high-liquidity tokens.

The speed matters. Once funds leave your wallet, the attacker can split them and scatter them across networks — making recovery far harder even when tracking is possible.

The Victim Impact: What Gets Lost (Beyond Money)

Large crypto theft numbers can feel abstract, but behind each drained wallet is a person or business that trusted their setup. In real cases, victims often report:

• Loss of long-term holdings (BTC, ETH, blue-chip positions) accumulated over years.
• Destroyed confidence in self-custody and digital security.
• Operational disruption for teams (treasury drains, payroll risk, paused launches).
• Stigma and silence: many avoid reporting due to embarrassment or fear.

Important: Victims of cybercrime are not “bad at crypto.” Most incidents happen because security is a system — and attackers only need one weak link.

What To Do If You Used a Password Manager for Crypto Secrets

If you stored seed phrases, private keys, or exchange API keys in any digital vault, the safest response is to assume the information could eventually be exposed.

Priority actions (practical and fast)

• Move funds from any wallet whose seed phrase may have been stored digitally to a new wallet.
• Rotate exchange passwords and enable strong 2FA (hardware keys where possible).
• Revoke API keys and issue new ones with minimal permissions.
• Audit approvals on EVM wallets (token allowances) and revoke suspicious approvals.
• Use hardware wallets for significant holdings and keep seed phrases offline.

Why This Story Matters for 2026 and Beyond

The LastPass-linked thefts are a reminder that crypto security isn’t only about blockchains. It’s also about: password hygiene, device security, backup code storage, and “where secrets live.” As crypto adoption expands through ETFs, banks, and mainstream apps, attackers are also evolving — increasingly targeting the off-chain components that control on-chain wealth.

Final quote: “In crypto, the hack isn’t always the blockchain — it’s the place you stored the key to your blockchain.”

Related Articles

• More crypto security & market updates on our homepage
• Bitcoin Calm May Be the Setup for a Major Breakout
• Lawsuit Alleges Insider Trading in Solana Meme Coin Market

This article is for informational purposes only and does not constitute legal, cybersecurity, or investment advice. If you believe you are a victim, consider documenting evidence and contacting qualified professionals or local authorities.