“I had my test account since 2018, and even today I can log in with my eight-character password without any warnings or prompts to change it.”
More than 150 victims have lost over $35 million in crypto, and the common thread is seed phrases stored in LastPass. The vaults stolen in 2022 can be brute forced offline forever. LastPass raised its iteration defaults from 1 to 500 to 5,000 to 100,100 and never finished migrating old accounts. It now cites pending litigation and declines to answer questions.