December and Christmas is ‘Hacker Season’: LastPass Breach Costs $5.4M in Crypto

As the world gears up for the joy of Christmas, hackers are hard at work, turning the festive season into a lucrative “hacker season.” The latest breach? LastPass hackers have stolen $5.4 million in crypto just a week before Christmas, leaving victims scrambling to secure their funds.

The attack is a grim reminder of the December 2022 LastPass data breach, which continues to wreak havoc on crypto users. If your private keys or seed phrases were stored on LastPass, your funds could be next.

Here’s everything you need to know about the latest theft, why December is hacker season, and how to protect your crypto.

1. $5.4M Stolen from LastPass Victims: The Latest Update

The latest LastPass crypto theft comes just eight days before Christmas, with hackers stealing $5.4 million worth of funds.

How Did This Happen?

• In December 2022, LastPass fell victim to a major data breach. Hackers accessed a backup of encrypted customer vault data, which included sensitive information like private keys and seed phrases.
• This stolen data continues to be exploited, with the total stolen crypto now nearing $45 million, including a $4.4 million theft on Oct. 25.

The Latest Attack Details:

• Stolen funds were swapped for Ether (ETH) and moved through instant exchanges, as confirmed by blockchain sleuth ZachXBT.
• Onchain evidence of the attacks has been submitted to the Chainabuse crypto scam reporting platform.

2. SEAL and Experts Sound the Alarm: Move Your Funds Now

The white hat hacker team Security Alliance (SEAL) has issued a stark warning:

“Move your assets before hackers move them for you.”

Who’s at Risk?

• If your crypto private keys or seed phrases were stored on LastPass before 2023, your funds are highly vulnerable to theft.
• The attack isn’t limited to crypto. Non-crypto funds were also targeted, with $250 million stolen in May alone from tens of thousands of victims.

What Should You Do?

• Immediately transfer any crypto funds connected to private keys stored in LastPass prior to 2023 to a new, secure wallet.
• Avoid using password managers for storing seed phrases or private keys. Instead, opt for cold storage or a hardware wallet.

3. December and Christmas: Why It’s “Hacker Season”

While December is a time for joy and celebration, it’s also a prime time for hackers.

Why Are December Hacks So Common?

1. Heightened Online Activity:
   • People are shopping, transferring money, and making transactions online, giving hackers more opportunities to strike.
2. Festive Scams:
   • Fake holiday promotions, phishing emails, and fraudulent offers are rampant during the holiday season.
3. Complacency and Distractions:
   • Many users are less cautious, busy with festive plans, and may overlook security best practices.

What Experts Are Saying:

• Cyvers, a blockchain security firm:
  • Warns that the “hacker season” is here, urging users to avoid free WiFi, be wary of anything “too festive,” and never share 2FA codes.
• Tay, a blockchain sleuth:
  • Calls for all LastPass users to secure their funds immediately before hackers take advantage of the breach.

4. The LastPass Breach: A Timeline of Damage

The December 2022 LastPass breach has resulted in an ongoing wave of thefts, targeting both crypto and non-crypto users.

Key Numbers to Know:

• Total Crypto Stolen: $45 million, including:
  • $5.4M in the latest attack.
  • $4.4M stolen on Oct. 25.
• Non-Crypto Theft: Over $250 million stolen from non-crypto accounts as of May 2023.

What Went Wrong?

• Hackers accessed encrypted backups of LastPass user vaults, including sensitive data like:
  • Private keys
  • Seed phrases
  • Passwords
• Once decrypted, this data has allowed attackers to repeatedly steal funds from unsuspecting victims.

5. Protect Yourself This Holiday Season

Tips to Secure Your Crypto:

1. Transfer Funds to a New Wallet:
   • If your private keys or seed phrases were stored on LastPass before 2023, move your assets to a new, secure wallet.
   • Use a hardware wallet like Ledger or Trezor for maximum security.
2. Don’t Store Private Keys Online:
   • Avoid using password managers, cloud storage, or unsecured devices to store your crypto credentials.
3. Enable Multi-Factor Authentication (MFA):
   • Use MFA for all crypto-related accounts, including wallets and exchanges.
4. Be Wary of Festive Scams:
   • Avoid clicking on suspicious links, sharing personal details, or responding to offers that seem “too good to be true.”
5. Stay Updated on Security Alerts:
   • Follow credible blockchain security experts like ZachXBT and platforms like Chainabuse for real-time updates.

Conclusion: Don’t Let Hackers Steal Your Christmas Cheer

The latest $5.4M LastPass crypto theft is a stark reminder of the importance of vigilance and proactive security. As the festive season brings heightened activity, hackers are taking advantage of complacency to exploit vulnerabilities.

If you’ve ever stored private keys or seed phrases on LastPass before 2023, the time to act is now. Transfer your funds to a secure wallet, and make sure you follow best practices to protect yourself during “hacker season.”

Let this serve as a lesson to stay alert—not just during the holidays, but year-round. In the world of crypto, your security is your responsibility.

FAQs

1. What happened in the December 2022 LastPass breach?
Hackers accessed an encrypted backup of LastPass customer vault data, which included sensitive information like private keys, passwords, and seed phrases.

2. How much crypto has been stolen in total?
So far, $45 million in crypto has been stolen from LastPass users, including $5.4 million in the latest attack.

3. How can I protect my funds if I used LastPass?

• Transfer your funds to a new wallet immediately.
• Avoid storing private keys or seed phrases on password managers.
• Use hardware wallets for added security.

4. Why is December called “hacker season”?
Hackers exploit the holiday season due to increased online activity, festive scams, and user complacency, making it a prime time for cyberattacks.

5. Are non-crypto accounts affected too?
Yes, non-crypto funds have also been targeted, with over $250 million stolen in May 2023 alone.

Stay informed and secure this holiday season with CryptoLiveLeak.org