Millions Stolen in Crypto Wallets Linked to 2022 LastPass Hack, TP-Link Routers Face Possible U.S. Ban Over National Security Concerns, Microsoft Pushes for a Passwordless Future with Passkeys
Welcome to Cyber Security Today, I’m your host, Jim Love. Let’s get into it.
Millions Stolen in Crypto Wallets Linked to 2022 LastPass Hack
The fallout from the 2022 LastPass breach is far from over, with millions of dollars in cryptocurrency stolen from victims’ wallets. This week, blockchain analyst ZachXBT reported an additional $5.36 million stolen from 40 crypto wallets. These thefts, ZachXBT claims, are the latest in a string of attacks tied to the massive LastPass breach.
The original breach allowed attackers to access both encrypted and unencrypted data, including API tokens, multi-factor authentication (MFA) seeds, and encrypted password vaults. While vaults were protected, weak or reused master passwords could be brute-forced, potentially exposing sensitive information like cryptocurrency seed phrases.
This isn’t an isolated incident. In October 2023, $4.4 million was stolen, followed by $6.2 million in February 2024. Overall, between August and December 2022, over $35 million was reportedly taken from 150 victims linked to the breach.
ZachXBT warns, “If you believe you’ve stored your seed phrase or keys in LastPass, migrate your crypto assets immediately.” Security experts continue to stress the importance of unique, strong passwords and recommend biometric-based authentication tools for additional protection.
LastPass maintains it has found no conclusive evidence directly connecting these thefts to its breach. However, these ongoing incidents underscore the risks of weak password management. The lesson is clear: even encrypted data is only as secure as the passwords protecting it.
TP-Link Routers Face Possible U.S. Ban Over National Security Concerns
TP-Link, the dominant router brand in the U.S., could soon face a ban over national security concerns. Federal investigations by the Departments of Commerce, Defense, and Justice are scrutinizing the Chinese-made devices, which have a history of vulnerabilities and potential misuse by state-backed hackers.
TP-Link holds 65% of the U.S. market for home and small business routers, with 11 of Amazon’s top 20 best-selling models, including the popular AX3000 and AX1800. However, the routers’ affordability and popularity come with risks. Microsoft recently identified TP-Link devices as part of a botnet, dubbed CovertNetwork-1658, used in sophisticated cyberattacks against Microsoft Azure customers, including U.S. Defense Department suppliers.
The concerns aren’t new. TP-Link routers have been implicated in several cyber incidents, including the Mirai botnet attacks and cases of custom malicious firmware infections attributed to Chinese state hackers. This year, a critical vulnerability in the Archer C5400X router earned a maximum CVSS score of 10.0, highlighting the ease with which attackers could gain full remote control.
The Justice Department is also probing TP-Link’s pricing strategy, suspecting that selling routers below manufacturing cost could be part of an anti-competitive practice. Meanwhile, a Chinese embassy spokesperson in Washington accused the U.S. of using security concerns as a pretext to suppress Chinese firms.
If a ban proceeds, it would mark another escalation in U.S.-China tech tensions. For TP-Link users, the uncertainty raises questions about future support and security patches. It’s a reminder that choosing budget-friendly tech can sometimes come at a higher long-term cost.
Microsoft Pushes for a Passwordless Future with Passkeys
Microsoft is doubling down on its vision for a passwordless future, promoting passkeys as a safer and easier alternative to traditional passwords. The company revealed in a recent blog post that it blocks 7,000 password attacks per second—nearly double the volume from last year—and faces a 146% increase in phishing attacks annually.
Passkeys offer a significant security upgrade by storing private encryption keys on local devices, such as phones, rather than on servers vulnerable to breaches. They eliminate the need to type credentials into websites, instead relying on biometric authentication, such as fingerprints or facial recognition. This makes them resistant to phishing attacks, as hackers would need both your device and your physical presence to gain access.
Microsoft has gradually rolled out passkey support across its ecosystem, including Xbox, Microsoft 365, and Copilot. By integrating passkeys into login prompts like “face, fingerprint, or PIN,” the company has made the transition seamless for users. Recent experiments showed that emphasizing passkeys as “faster” or “more secure” increased adoption rates by over 24%.
The company has also been nudging users toward passkeys at key moments, such as during account creation or password resets. While Microsoft still allows users to “skip for now,” its long-term goal is to phase out passwords entirely. The path forward includes making passkeys the default, removing passwords altogether, and fully adopting phishing-resistant credentials.
This shift highlights a growing consensus in cybersecurity: the password, once a cornerstone of online security, is now a weak link. For organizations and individuals, adopting passwordless technologies may soon become not just an option but a necessity.
That’s our show for today. You can find links in our show notes at technewsday.com or .ca, take your pick. You can reach me with comments, questions or tips at editorial@technewsday.ca. I’m your host Jim Love, Thanks for listening!
