10.4 C

LastPass security breach linked to $35 million stolen in crypto heists



Security experts are claiming that some of the LastPass password vaults stolen during a security breach near the end of 2022 have now been cracked open following a string of six-figure cryptocurrency heists. Cybersecurity blogger Brian Krebs reports that several researchers have identified a “highly reliable set of clues” that seemingly connect over 150 victims of crypto theft with the LastPass service. Collectively, over $35 million in crypto has reportedly been stolen so far, with between two to five high-value heists occurring each month since December 2022.

Taylor Monahan, lead product manager at crypto wallet company MetaMask and one of the key researchers investigating the attacks, concluded that the common thread connecting the victims was that they’d previously used LastPass to store their “seed phrase” — a private digital key that’s required to access cryptocurrency investments. These keys are often stored on encrypted services like password managers to prevent bad actors from gaining access to crypto wallets. The stolen funds were also moved to the same blockchain addresses, further linking the victims.

Password management service LastPass suffered two known security breaches in August and November last year, with hackers using information obtained during the first breach to access shared cloud storage containing customer encryption keys for vault backups during the latter incident. We have reached out to LastPass to confirm if any of the stolen password vaults have been cracked and will update this story if we hear back.

In a statement to The Verge, LastPass CEO Karim Toubba says that the security breach last November remains “the subject of an ongoing investigation by law enforcement and is also the subject of pending litigation.” The company did not say whether the 2022 LastPass breaches have anything to do with the reported crypto thefts.

Researcher Nick Bax, director of analytics at crypto wallet recovery company Unciphered, also reviewed the theft data and agreed with Monahan’s conclusions in an interview with KrebsOnSecurity:

“I’m confident enough that this is a real problem that I’ve been urging my friends and family who use LastPass to change all of their passwords and migrate any crypto that may have been exposed, despite knowing full well how tedious that is.”

Source link

Subscribe to our magazine

━ more like this

America’s landfills are ‘garbage lasagnas’

America’s landfills—and the environmental havoc they create—are sizable. There are roughly 1,200 landfills currently in operation and on average, each one takes up...

You can get rid of AI Overviews in Google Search

If you’ve searched for something on Google lately, you might’ve noticed a wall of text that appears before the actual search results. This...

The only 4 steps you need to take to learn web development

According to Google, as a mobile web page’s load time reaches 10 seconds, the probability of its visitors bouncing (i.e., leaving the site)...

FCC introduces effectively toothless proposal that would regulate AI everywhere except streaming

The head of the Federal Communications Commission introduced on Wednesday a proposal to require political advertisers to disclose when they use content generated...

10 of the highest-paying public health jobs right now

Even before the pandemic hit, the field of public health had been experiencing explosive growth, with the number of public health degrees awarded...