Ripple Co-Founder’s $150M Crypto Theft Traced to LastPass Breach

Chris Larsen, co-founder of Ripple, fell victim to a massive $150 million crypto theft, which investigators now link to a security breach in the password manager LastPass.
Blockchain analyst ZachXBT uncovered details in a forfeiture complaint, revealing that hackers accessed Larsen’s wallets using stolen private key data from LastPass, which was compromised in 2022.
LastPass suffered two major breaches that year, exposing encrypted vaults containing sensitive user information. Larsen had stored his private keys in the service, eliminating any physical copies.
His vault, secured by a strong password, remained accessible on multiple devices known only to close family members. Investigators believe attackers used stolen vault data to infiltrate not just Larsen’s accounts but those of other victims as well.
READ MORE: U.S. Strategic Bitcoin Reserve May Be Funded by Gold Sales, Proposes Standard Chartered
The breach came to light on January 31, 2024, when Larsen detected unauthorized access to his XRP holdings. Hackers siphoned 213 million XRP—valued at $112.5 million—rapidly dispersing the funds through various crypto exchanges. His team rushed to freeze affected addresses but withheld details on how the attack occurred.
The lack of transparency sparked criticism from ZachXBT, who argued that Larsen should have disclosed the root cause earlier or taken action against LastPass for its role in the security failure.