LastPass Referral Code

This page is not really about a referral bonus. If you held a LastPass vault in 2022 and have not since rotated what was in it, there is something you need to know, and it is still happening.

In 2022 LastPass suffered a two-stage compromise. Attackers first breached a developer environment and took portions of the company's source code. Then, using credentials obtained in that intrusion, they breached the cloud storage provider GoTo and took LastPass database backups — including encrypted vault backups for approximately 30 million vaults.

The critical property of that theft is not what was decrypted at the time. It is that the attackers hold the data.

An encrypted vault sitting on an attacker's disk can be attacked forever. There is no lockout, no rate limit and no expiry — they can try master passwords offline, at whatever speed their hardware allows, for as many years as they care to. A strong, unique, high-iteration master password remains very hard to break. A weak one, a reused one, or one protected by an older key-derivation configuration does not, and older accounts were disproportionately exposed to exactly that.

The consequences have been measured rather than theorised. TRM Labs has traced more than US$35 million in cryptocurrency thefts to the stolen vault backups, with on-chain indicators suggesting Russian cybercriminal involvement. More than US$28 million was converted to Bitcoin and laundered through Wasabi in late 2024 and early 2025, with off-ramps including Russia-based exchanges — one of which had previously been sanctioned for facilitating ransomware laundering. Wallet drains tied to the breach continued through late 2025.

Crypto seed phrases were hit hardest because they are the perfect target: irreversibly valuable, instantly liquid, and commonly stored in password managers as secure notes. But the vaults contained everything else people store — banking logins, email credentials, recovery codes — and those do not announce themselves when they are used.

So the practical instruction, which matters more than anything else on this page. If you had a LastPass vault at any point in 2022:

Treat everything that was in it as compromised, regardless of how strong you believe your master password to be, because you cannot detect an offline cracking attempt. Rotate passwords for every account that was stored, prioritising email first — because email recovers everything else — then financial accounts, then the rest. If any crypto seed phrase or private key was ever stored in that vault, move the funds to a newly generated wallet; rotating a seed phrase is not possible, so the only remedy is migration. Enable hardware-backed two-factor authentication wherever it is offered, since it survives a stolen password. And check any account that offered recovery codes, because those were commonly stored in vaults and commonly forgotten.

None of that is a comment on whether password managers are a good idea — they are, and using one remains far safer than reusing passwords across sites. It is a comment on a specific incident whose exploitation window has now run for over three years and has not closed.

On the referral: this site is not going to lead a page with a bonus when the more useful thing to hand someone is a list of accounts to rotate. If you want a password manager, the questions to ask are what happens to vault backups, how key derivation is configured, and whether the provider has published an independent audit.