Experts Fear Crooks are Cracking Keys Stolen in Last Pass Breach
Summary: Security researchers led by MetaMask's Taylor Monahan have linked a signature across thefts from more than 150 confirmed victims who lost over $35 million in crypto since December 2022, with roughly two to five high-dollar heists per month, and concluded the common thread was that victims had stored their seed phrases in LastPass. LastPass disclosed in November 2022 that hackers stole encrypted and plaintext vault data for more than 25 million users, and the attackers had reached a DevOps engineer's corporate vault by exploiting an unpatched 2020 Plex media server vulnerability to install a keylogger that captured his master password after MFA.
What you should know: The seed phrase is the money: anyone holding it can move every asset tied to that key, and stolen vaults can be attacked offline at millions of guesses per second, with older LastPass accounts defaulting to as few as 1 to 500 iterations.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026