In January 2024, Chris Larsen — co-founder of the cryptocurrency company Ripple — lost roughly $150 million in crypto to a single theft. Federal investigators eventually linked it to a password manager breach that had happened a year and a half earlier, at a company he’d stopped thinking about. The vault backup stolen from LastPass in 2022 was still being cracked open, one master password at a time, in 2024.

That’s the story that makes people ask whether password managers are safe at all. Wrong question. The right one: what actually failed, and how do you avoid the same failure in your own vault?

TL;DR

  • The 2022 LastPass breach started with an attacker exploiting outdated Plex media server software on a DevOps engineer’s home computer, then keylogging their master password.
  • The stolen encrypted vault backups were cracked offline for years afterward — researchers and the FBI have tied over $35 million (and separately, a $150 million heist) in stolen cryptocurrency to victims whose vaults had weak master passwords or low KDF (Key Derivation Function) iteration counts.
  • Zero-knowledge architecture — where your vault is encrypted on your device before it ever reaches the vendor’s servers — is what limited the damage. Attackers got ciphertext, not plaintext.
  • How well that protection holds depends heavily on your master password strength and the vendor’s KDF settings — LastPass had left many accounts on iteration counts set a decade earlier.
  • Password managers are still dramatically safer than password reuse. The fix isn’t abandoning them — it’s choosing one with strong defaults and using a genuinely strong, unique master password.

Table of Contents

Why This Matters to You

If you use a password manager — or you’re deciding whether to start — the LastPass story is the most relevant case study in the industry’s history. It shows what a vendor-level breach can cost you, and which choices materially change your exposure when encrypted vault data is stolen.

This applies whether you’re a home user with a handful of accounts or an IT professional choosing what to roll out organization-wide. The failure modes are identical; only the blast radius differs.

What Actually Happened at LastPass

The breach that damaged LastPass’s reputation was actually two connected incidents, and the details matter more than the headlines did at the time.

Incident one, August 2022: An attacker compromised a LastPass software engineer’s corporate laptop and got into a cloud-based development environment, stealing source code, technical documentation, and internal system secrets. LastPass’s security team was alerted on August 12, 2022, and disclosed the incident publicly on August 25, 2022. An initial investigation with incident-response firm Mandiant found the intrusion lasted four days and concluded there was no evidence customer data or encrypted vaults had been accessed.

That conclusion turned out to be wrong.

Incident two, August–October 2022: The attacker used information from the first incident to go after one of only four LastPass DevOps engineers with access to the company’s shared cloud storage. LastPass says the attacker exploited CVE-2020-5741 — a remote-code-execution flaw in Plex Media Server that Plex had patched in May 2020 — running unpatched on the engineer’s home computer. Through that hole the attacker planted keylogger malware, capturing the employee’s master password as it was typed, right after the employee had authenticated with multi-factor authentication (MFA — a login step requiring a second proof of identity, like a code from an app).

That single captured master password gave the attacker a decryption key into the engineer’s own corporate vault, and from there into cloud storage holding backups of customer password vaults. LastPass disclosed this on November 30, 2022, confirming encrypted vault data — plus some unencrypted metadata like website URLs — for more than 25 million users had been taken.

The lesson isn’t “a company’s software had a bug.” It’s that a personal media server, an unapplied patch, a keylogger, and one employee’s master password combined to compromise vaults belonging to 25 million strangers. Home-computer hygiene at one employee’s house became a supply-chain risk for everyone else. See our guide on mandatory home computer security actions for exactly this class of unpatched “it’s just for movies” device.

How the Stolen Vaults Turned Into Stolen Crypto

Stealing an encrypted vault backup doesn’t hand an attacker your passwords. It hands them a locked box they can attack at their own pace, forever, with no rate limiting and no lockout — an offline brute-force attack, where guesses happen on the attacker’s own hardware rather than against the real service.

It took almost a year to surface. In September 2023, journalist Brian Krebs published research from independent investigators connecting a wave of six-figure cryptocurrency thefts — over $35 million from roughly 150 victims — to master passwords cracked from the stolen LastPass vaults. The common thread: victims had stored crypto wallet seed phrases inside their vaults, with none of the usual signs of crypto theft like a SIM-swap or compromised email. Attackers appear to have used stolen vault metadata — which sites a vault held credentials for — to prioritize cracking vaults mentioning crypto exchanges.

The thefts kept happening. In March 2025, Krebs reported that federal agents investigating a $150 million cryptocurrency theft from Ripple co-founder Chris Larsen in January 2024 reached the same conclusion: the theft traced back to a master password cracked from a vault stolen in 2022. Prosecutors seized about $24 million of the stolen funds that March.

The gap between “vault stolen” (2022) and “money stolen” (still happening in 2024–2025) is the part people miss. An offline attack against a weak master password has no deadline — it can succeed years later, whenever the attacker’s hardware catches up.

Why the Vault Wasn’t Instantly Readable: Zero-Knowledge Architecture

Here’s the reassuring part, if you understand it. LastPass didn’t hand attackers your passwords in plaintext — they handed over encrypted blobs. The reason that mattered at all is an architecture called zero-knowledge encryption.

In a zero-knowledge design, your vault is encrypted and decrypted entirely on your own device, using a key derived from your master password. The vendor’s servers only ever store and sync the encrypted result — the vendor never has your master password and, in principle, never has the ability to read your vault, even under a court order, even after a full server breach.

Think of it like a bank that stores your safe deposit box but never holds a key to it — only you have the key, generated at home. If a thief breaks into the vault room, they get a room full of locked boxes, not open ones.

That’s why the LastPass breach became a slow-motion cracking campaign instead of an instant catastrophe: attackers had ciphertext, and turning it into plaintext required guessing each user’s master password individually. For users with strong, unique master passwords and modern KDF settings, that guessing is still computationally infeasible. For users without them, it wasn’t.

KDF Iterations: The Setting That Decided Who Got Robbed

One major difference between vaults that resisted cracking and those that did not was a number most users never look at: the KDF (Key Derivation Function) iteration count. Master-password strength and the data stored in each vault mattered too.

A KDF turns your master password into the actual encryption key protecting your vault. Instead of using your password directly as a key — which would make guessing trivial — a KDF runs it through a deliberately slow, repeated hashing process thousands or hundreds of thousands of times. Each repetition is an iteration; more iterations means more computation per guess, and slower brute-forcing.

LastPass used PBKDF2 (Password-Based Key Derivation Function 2), and according to independent researcher Wladimir Palant’s analysis of the breach, its default iteration count had a troubled history:

PeriodDefault PBKDF2 iterations
Originally1
From June 2012500
From February 20135,000
From February 2018100,100

Critically, LastPass raised the default for new accounts over time but never forced existing accounts onto the stronger setting — many stayed on 500 or 5,000 iterations unless the user manually changed it, something LastPass had promised to fix since 2018. Palant calculated that a vault at 500 iterations could be cracked by a single consumer GPU in about a year for a moderately strong password; at 5,000 iterations, around a decade; at 100,100 iterations, roughly 200 years, using late-2022 GPU cracking-cost estimates. Even that strongest 2022-era default fell short of what OWASP (Open Web Application Security Project) recommended at the time — 310,000 iterations for PBKDF2-SHA256. Current OWASP guidance recommends Argon2id for new password-storage designs. Where PBKDF2-HMAC-SHA256 is required, including some FIPS-constrained environments, OWASP lists 600,000 iterations as the minimum work factor.

The practical takeaway: two people on the same password manager, with the same breach exposure, can have wildly different outcomes based on an iteration-count setting they never touched.

How Competitors Compare

No major consumer password manager has an unblemished history, but severity differs enormously. This is what’s independently documented, not a marketing ranking.

VendorConfirmed vault breach?Notable incidentSource
LastPassYes, 2022Encrypted vaults for 25M+ users stolen; tied to ongoing crypto theftsLastPass, Krebs on Security
1PasswordNo confirmed vault breachDetected suspicious activity on its own Okta admin account after the 2023 Okta support-system breach; investigated and found no compromise of user data1Password, The Hacker News
BitwardenNo confirmed breach as of 20262023 autofill-into-iframe behavior flagged by researchers as a phishing risk, since addressedBitwarden, security researchers
DashlaneNo confirmed vault breachFlagged in a 2026 academic study for legacy cryptography enabling a downgrade attack; patched November 2025ETH Zurich / USI research, Dashlane

1Password’s Okta-linked incident shows the model working as intended: attackers reached an internal admin tool, but the company’s architecture — a locally-generated “Secret Key” combined with the master password to derive the vault encryption key, so the vendor’s servers alone are never sufficient to decrypt a vault — meant touching internal systems didn’t translate into vault access.

2026 Reality Check: Zero-Knowledge Isn’t Bulletproof Either

Zero-knowledge architecture reduces the blast radius of a server breach. It doesn’t make these products invulnerable, and a February 2026 academic study is a useful corrective to any claim that “zero-knowledge” means “unbreakable.”

Researchers from ETH Zurich and the Università della Svizzera italiana published “Zero Knowledge (About) Encryption: A Comparative Security Analysis of Three Cloud-based Password Managers,” examining Bitwarden, LastPass, and Dashlane, with related findings extending to 1Password. Simulating a malicious or compromised vendor server, they identified 27 distinct attacks across the products — ranging from tampering with one user’s vault to, in some scenarios, compromising every vault in an organization. The paper is set for USENIX Security 2026.

Vendor responses varied: Dashlane patched the legacy cryptography behind its worst-rated issue by November 2025; Bitwarden fixed most flagged issues but called some intentional design trade-offs; 1Password said the findings reflected already-documented architectural limitations, not new attack vectors.

None of this puts these products on par with what happened at LastPass — a full vault-backup theft is categorically worse than a theoretical attack requiring an actively hostile server. But it’s a reminder that “zero-knowledge” is a design goal, not a guarantee, and the field is still being actively stress-tested by independent researchers.

Where Passkeys Fit In

Passkeys are a genuinely different technology, solving a different part of the problem. A passkey is a cryptographic key pair generated on your device — the private key never leaves it, and nothing resembling a shared secret is ever transmitted to the site you’re logging into. That’s why passkeys can’t be phished or reused the way a password can, no matter how it’s stored.

Most modern password managers now also store and sync passkeys alongside traditional passwords — useful, but it means your master password is now protecting your passkeys too. For the full technical breakdown of how passkeys work and how attackers adapt with downgrade attacks, see Passkeys and FIDO2: The End of Passwords — and What Attackers Do Next. The short version here: passkeys are the long-term direction, but most of the internet still runs on passwords, which is exactly why password manager security still matters right now.

Choosing a Password Manager: What to Actually Check

What to checkWhy it mattersGood sign
KDF algorithm and iteration countDetermines how fast a stolen vault can be brute-forced offlineArgon2id, or PBKDF2 at 600,000+ iterations
Zero-knowledge architectureDetermines whether the vendor can read your vault at allVendor explicitly states it cannot decrypt your data, and publishes how
Independent security auditsVerifies the vendor’s claims against outside reviewRecent, published third-party audit reports
Breach and incident transparencyShows how the vendor behaves under pressurePublic, detailed incident disclosures — not silence
MFA on the vault account itselfAdds a barrier beyond the master password aloneSupports authenticator apps or hardware security keys, not just SMS
Local/offline vault optionLimits exposure if the vendor’s cloud is compromisedVault can function without syncing to the vendor’s servers
Browser extension permissionsThe extension is a common attack surfaceExtension requests minimal permissions, has a clean audit history

What You Can Do Today

  • Make your master password long, not clever. Following NIST guidance (Special Publication 800-63B), aim for at least 15 characters — a random passphrase of four or five unrelated words beats a short password with substitutions.
  • Never reuse your master password anywhere else. It’s the single key to your whole vault — it must exist nowhere else, ever.
  • Turn on MFA for your password manager account itself, ideally an authenticator app or hardware key, not SMS (see SIM swapping for why).
  • Check your KDF settings if your provider exposes them, and raise them (or switch providers) if they’re old or low.
  • Don’t store crypto seed phrases in “Secure Notes.” That’s precisely what turned a vault breach into a multi-million-dollar theft for hundreds of LastPass users — use a hardware wallet instead.
  • Audit your browser extensions periodically — the extension is what autofills your credentials, so it needs to be trustworthy.
  • If you were a LastPass user before 2022 and never rotated your master password since, do it now, and change anything sensitive that was stored in that vault.

The Bottom Line

The LastPass breach is a real, well-documented failure — an unpatched home media server, a keylogged master password, years of downstream cryptocurrency theft. It isn’t evidence that password managers are unsafe. It shows why two protections deserve particular scrutiny: whether the vendor’s architecture keeps your vault genuinely unreadable to itself, and whether your own master password is strong enough that an offline attacker with unlimited time still fails.

Get both right, and a server-side breach is far less likely to turn an encrypted vault backup into readable credentials. Get either wrong, and you’re relying more heavily on the attacker never getting around to your vault. Given what happened to LastPass users between 2022 and 2025, that’s not a bet worth making.

Sources