A recent forfeiture complaint by U.S. law enforcement revealed that Ripple co-founder Chris Larsen lost $150 million in XRP due to compromised private keys stored in Lastpass, a password manager breached in 2022, according to onchain investigator ZachXBT and the complaint filing.
Ripple Co-Founder Chris Larsen Lost $150M in XRP Due to Lastpass Hack, Forfeiture Complaint Says
This article was published more than a year ago. Some information may no longer be current.
WRITTEN BY
SHARE
Private Keys Stored in Lastpass Resulted in $150M Crypto Hack, Feds Allege
The complaint, filed Jan. 24, 2024, outlined that hackers stole approximately 283 million XRP (worth roughly $150 million at the time) from Larsen’s wallet in early 2024. Authorities traced the theft to the 2022 Lastpass breach, which exposed user data, including encrypted password vaults. While Lastpass maintained that user master passwords were not compromised, hackers allegedly leveraged stolen credentials to access Larsen’s private keys.
ZachXBT, a prominent onchain investigator, first detailed the findings in a Telegram post, noting that Larsen had not previously disclosed the cause of the theft. The hack stemmed from storing private keys in Lastpass, ZachXBT post notes, citing the forfeiture complaint as evidence. The post highlights how lapses in security practices, even among high-profile figures, can lead to significant financial losses.
The 2022 Lastpass breach compromised data from millions of users after attackers infiltrated a third-party cloud storage system. While the company urged users to update passwords, the incident highlighted vulnerabilities in centralized password management. In Larsen’s case, the stolen keys granted hackers direct access to his cryptocurrency holdings, bypassing typical security measures.
Larsen, who co-founded Ripple in 2012, has not publicly commented on the specifics of the hack or subsequent recovery efforts. Authorities have not named suspects, but the case showcases growing scrutiny of cybersecurity practices in the crypto industry. The incident serves as a cautionary tale for investors and executives, emphasizing the risks of storing sensitive information like private keys in platforms like Lastpass, which are vulnerable to breaches.
