According to a report by blockchain analysis firm TRM Labs, Russian cybercriminals are likely behind the laundering of over $35 million in cryptocurrency stolen from LastPass users. This amount is directly linked to the 2022 LastPass password manager breach and has been gradually withdrawn over several years, potentially extending until the end of 2025.
TRM Labs states that hackers use security protocols and mixing services such as Wasabi Wallet and CoinJoin to conceal the flow of funds, then transfer the assets to platforms connected with Russia. A significant portion has been traced back to Cryptex – a trading platform currently sanctioned by OFAC – and Audi6, another service within the Russian cybercrime ecosystem.
Despite using anonymity technologies, analysts have successfully “unmixed” transactions through on-chain behavior analysis, thereby clarifying the role of cryptocurrency platforms in Russia in facilitating global cybercrime activities.