A $150 million theft targeting Ripple co-founder Chris Larsen has been traced back to a security lapse involving the password manager LastPass, according to a forfeiture complaint filed by U.S. law enforcement on March 6 flagged by blockchain sleuth ZachXBT.

ZachXBT shared that the complaint detailed how Larsen’s private keys — or code to access one’s token holdings — were stored in LastPass, the widely used password manager that suffered a major breach in 2022.

At the time, hackers stole source code and technical data by compromising a developer’s account. By November of that year, they used this access to infiltrate a cloud storage system, stealing encrypted customer password vaults and unencrypted metadata for an estimated 25 million users.

Although ‘vaults’ were encrypted, weak or reused master passwords could be brute-forced, exposing stored data.

Hackers exploited this vulnerability, accessing Larsen’s keys and siphoning off the XRP, valued at $150 million at the time of the theft and over $600 million as of Saturday’s prices.

“A forfeiture complaint filed yesterday by US law enforcement revealed the cause for the ~$150M (283M XRP) hack of Ripple co-founder, Chris Larsen’s wallet in Jan 2024 was the result of storing private keys in LastPass (password manager which was hacked in 2022),” ZachXBT wrote on his Telegram channel.

“Up to this point Chris Larsen had not publicly disclosed the cause of the theft,” he added.

Larsen confirmed the incident in January, where he clarified the hack affected only his personal accounts, not Ripple’s corporate wallets. He is yet to publicly comment on the forfeiture notice.

The fallout from the 2022 LastPass hack has been extensive and remain ongoing. In December, The Security Alliance (SEAL), a team of cybersecurity experts focused on the crypto market, estimated that crypto losses connected to the breach had touched at least $250 million as of May 2024.

A forfeiture complaint shared by blockchain detective ZachXBT revealed that the $150 million hack suffered by Ripple co-founder Chris Larsen resulted from private keys stored in the password manager LastPass, which was compromised in 2022. 

The complaint details how the attackers accessed Larsen’s cryptocurrency wallets through stolen vault data from LastPass.

LastPass compromise

In December 2022, LastPass suffered two major data breaches, one in August and another in November, which resulted in the theft of encrypted passwords and vault data. 

According to the complaint, Larsen — referred to as Victim 2 — stored private keys in LastPass’ password vault, which also contained secure notes, banking information, and other credentials.

According to Larsen, he destroyed any physical record of the private keys after inputting them in the password vault. A long, unique password secured access to the online password manager, and devices remained logged for up to 30 days.

At least four devices had access to the account containing the private keys, and only Larsen’s family members were aware of the passcode to any of these devices. 

The FBI has been investigating the LastPass breach, and law enforcement agents working on Larsen’s case have spoken with FBI agents regarding the stolen data. 

The investigation suggests that attackers used the compromised vault data to gain unauthorized access to multiple victims’ cryptocurrency accounts, electronic accounts, and other sensitive information.

The hack

Larsen first disclosed the hack on Jan. 31, 2024, stating that unauthorized access had been detected in several of his personal XRP accounts. 

The attackers stole approximately 213 million XRP, valued at $112.5 million at the time. The stolen funds were laundered through crypto exchanges, including Binance, Kraken, OKX, Gate, MEXC, HTX, and HitBTC.

Larsen and his team immediately notified crypto exchanges to freeze affected addresses but did not publicly reveal any further details about the hack.

ZachXBT questioned Larsen’s decision to hide the cause of the theft. He said:

“Only if Chris Larsen had shown basic transparency with sharing their findings for the root cause prior to this or had helped organize a class action against LastPass.”

Mentioned in this article