ZachXBT

Security

The notorious LastPass hackers may have just ruined Christmas for another 40 victims by stealing $5.36 million from LastPass users — just eight days before the holiday.&nbsp;
LastPass <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/lastpass-attacker-stole-password-vault-data-showing-web2-s-limitations" rel="null" target="null" text="null" title="null">fell victim to a data breach</a> in December 2022, when the hackers were able to copy a backup of customer vault data from encrypted storage.
As of September, more than $35 million worth of crypto had been stolen — but factoring in the $5.36 million and a <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/lastpass-breach-hacker-steals-millions-crypto-wallets-zachxbt" rel="null" target="null" text="null" title="null">$4.4 million incident</a> from Oct. 25 would bring that figure closer to $45 million.
The most recent attack saw the stolen funds swapped for Ether (<a data-ct-non-breakable="null" href="https://cointelegraph.com/ethereum-price" rel="null" target="null" text="null" title="null">ETH</a>) and transferred to “various instant exchanges,” blockchain sleuth ZachXBT <a data-ct-non-breakable="null" href="https://t.me/investigations/191" rel="null" target="null" text="null" title="null">noted</a> in a Dec. 17 message to his 48,400 Telegram subscribers.
ZachXBT <a data-ct-non-breakable="null" href="https://www.chainabuse.com/report/0ea24e3c-0b02-46f4-bb5d-5196700f0149?context=browse-all" rel="null" target="null" text="null" title="null">submitted</a> onchain evidence of the latest LastPass attacks on the crypto scam reporting platform Chainabuse.
It’s a stern reminder that all <a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/articles/public-key-vs-private-key" rel="null" target="null" text="null" title="https://cointelegraph.com/learn/articles/public-key-vs-private-key">private keys</a> and seed phrases stored on password manager LastPass before 2023 are at risk, white hat hacker team Security Alliance (SEAL) <a data-ct-non-breakable="null" href="https://x.com/_SEAL_Org/status/1868805837311074576" rel="null" target="null" text="null" title="https://x.com/_SEAL_Org/status/1868805837311074576">said</a> in a Dec. 16 X post, adding: 
<blockquote>
 “Move your assets before hackers move them for you.”
</blockquote>
Non-crypto funds have been stolen too, with $250 million of funds <a data-ct-non-breakable="null" href="https://x.com/tayvano_/status/1788039611627000244" rel="null" target="null" text="null" title="null">estimated</a> to have been stolen in May from “tens of thousands of thefts,” blockchain sleuth Tay said on X.&nbsp;
SEAL and Tay are two of the many crypto advocates calling for former LastPass users to transfer their funds from LastPass before it is too late.
<h2 id="december-and-christmas-is-hacker-season">December and Christmas is ‘hacker season’</h2>
The most recent batch of LastPass hacks comes amid an uptick in scams leading up to the <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/bitcoin-sets-new-all-time-high-above-105000" rel="null" target="null" text="null" title="null">Christmas festive season.</a>
Blockchain security firm Cyvers <a data-ct-non-breakable="null" href="https://x.com/CyversAlerts/status/1868719239252635825" rel="null" target="null" text="null" title="null">stressed</a> that “hacker season” has now arrived and urged everyone not to “trust anything that looks too festive,” to not reveal one’s 2FA codes and to even avoid connecting to free WiFi.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/ethical-hackers-alliance-crypto-hack-protection" rel="null" target="null" text="null" title="https://cointelegraph.com/news/ethical-hackers-alliance-crypto-hack-protection">White hat ‘SEAL’ team protecting from crypto hacks surpasses 900 investigations</a> Meta, the social media giant behind Facebook, Instagram and WhatsApp, also recently sent a warning to its users, <a data-ct-non-breakable="null" href="https://about.fb.com/news/2024/12/meta-launches-global-anti-scam-awareness-campaign-ahead-of-the-holiday-season/" rel="null" target="null" text="null" title="https://about.fb.com/news/2024/12/meta-launches-global-anti-scam-awareness-campaign-ahead-of-the-holiday-season/">identifying</a> several scam campaigns targeting holiday shoppers from fake Christmas gift box promotions, fraudulent holiday decoration sales and counterfeit retail coupons.
Crypto scammers could be looking to make up for lost ground this holiday season after phishing losses <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/crypto-phishing-scams-rise-holidays-9-3-m-nov-cyvers" rel="null" target="null" text="null" title="null">fell 53% month-on-month</a> in November to $9.3 million.
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/seal-911-team-white-hat-forms-fight-crypto-hacks-real-time/" rel="null" target="null" text="null" title="null">‘SEAL 911’ team of white hats formed to fight crypto hacks in real time</a>

LastPass threat actor steals $5.4M from victims just a week before Xmas

Table of Contents

Cointelegraph

Other articles published on Dec 17, 2024

BlackRock vs. MicroStrategy: Who Has the Better Bitcoin Strategy?

Binance Labs Recent Investment: What is Astherus?

Justin Sun Sends Another Mysterious Message: “Something Big is Coming”

Grayscale Joins Race for Spot Solana ETF

India Crypto Regulations: A Look at Upcoming Framework

Bitget Wallet Launches GetGas To Simplify Multi-Chain Gas Fee Payment (17 Dec)

Join our free newsletter for daily crypto updates!