Curriculum·S205 On-Chain and Fundamental Data·about 31 min
Following the money
By the end of this lesson you can
- →Cluster addresses from funding, timing and behavior, and label the output as inference
- →Explain what a flow to an exchange does and does not establish about intent
- →Apply the corroboration step that converts a cluster into a finding
- →State the mechanism by which copying a wallet underperforms the wallet, and defer the full treatment
Sophomore · enrolled learners
This lesson opens with How the LastPass losses were connected.
- What happened
- Beginning in late 2022, researchers Taylor Monahan and Nick Bax observed a run of six-figure thefts from experienced holders who showed none of the usual indicators of compromise, with no SIM swap, no email takeover and no phishing event. Working from the other end, they traced proceeds from many separate victims and found them arriving at shared blockchain addresses, which linked victims who had no other apparent connection to each other. Interviewing the linked victims produced the common factor: each had at some point stored a seed phrase in the Secure Notes section of LastPass, whose 2022 breaches exposed roughly 30 million encrypted vaults. Federal investigators later linked a $150M theft in January 2024 to the same breaches, and independent researchers connected the dataset to more than $438M in losses by mid 2025.
- The decision point
- The clustering did not identify the cause. It identified a set of victims who shared something, and the something was found by interviewing them. On-chain analysis established the connection and could not have established what it was, because the common factor was an off-chain event years earlier. Every conclusion in this lesson has that shape: the chain narrows the hypothesis and corroboration decides it.
- Recorded loss
- $150,000,000
What you will be able to answer
- →What are the four clustering signals?
- →What does a transfer to an exchange establish?
- →What converts a cluster into a finding?
- →Why does copying a wallet underperform the wallet?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://krebsonsecurity.com/2025/03/feds-link-150m-cyberheist-to-2022-lastpass-hacks/
- https://thehackernews.com/2025/12/lastpass-2022-breach-led-to-years-long.html
- https://www.trmlabs.com/resources/blog/trm-traces-stolen-crypto-from-2022-lastpass-breach-on-chain-indicators-suggest-russian-cybercriminal-involvement
- https://www.s-rminform.com/latest-thinking/crypto-crash-three-arrows-capital
Confidence medium·Volatility high·Reviewed 2026-08-06·Owner unassigned
Contested
F106-05 uses the LastPass cluster to teach how target lists are built and how long exposure persists. This lesson uses it to teach the tracing method and the corroboration step. Keep the split.
Attribution of specific thefts to the LastPass breach is investigative and circumstantial, built from on-chain clustering plus victim interviews and later supported by federal seizures. It is strong and it is not a court finding in every case. Say linked, not proven.
Copy trading is deferred to R410 by an explicit scope decision recorded in the tree. This lesson states the mechanism briefly and does not develop it. Do not let a revision expand this section.