A forfeiture complaint shared by blockchain detective ZachXBT revealed that the $150 million hack suffered by Ripple co-founder Chris Larsen resulted from private keys stored in the password manager LastPass, which was compromised in 2022.
The complaint details how the attackers accessed Larsen’s cryptocurrency wallets through stolen vault data from LastPass.
LastPass compromise
In December 2022, LastPass suffered two major data breaches, one in August and another in November, which resulted in the theft of encrypted passwords and vault data.
According to the complaint, Larsen — referred to as Victim 2 — stored private keys in LastPass’ password vault, which also contained secure notes, banking information, and other credentials.
According to Larsen, he destroyed any physical record of the private keys after inputting them in the password vault. A long, unique password secured access to the online password manager, and devices remained logged for up to 30 days.
At least four devices had access to the account containing the private keys, and only Larsen’s family members were aware of the passcode to any of these devices.
The FBI has been investigating the LastPass breach, and law enforcement agents working on Larsen’s case have spoken with FBI agents regarding the stolen data.
The investigation suggests that attackers used the compromised vault data to gain unauthorized access to multiple victims’ cryptocurrency accounts, electronic accounts, and other sensitive information.
The hack
Larsen first disclosed the hack on Jan. 31, 2024, stating that unauthorized access had been detected in several of his personal XRP accounts.
The attackers stole approximately 213 million XRP, valued at $112.5 million at the time. The stolen funds were laundered through crypto exchanges, including Binance, Kraken, OKX, Gate, MEXC, HTX, and HitBTC.
Larsen and his team immediately notified crypto exchanges to freeze affected addresses but did not publicly reveal any further details about the hack.
ZachXBT questioned Larsen’s decision to hide the cause of the theft. He said:
“Only if Chris Larsen had shown basic transparency with sharing their findings for the root cause prior to this or had helped organize a class action against LastPass.”