Same Address. Hundreds of Wallets. All Drained the Same Day.
On-chain investigator Wazz recently disclosed an alarming incident: hundreds of wallets on the Ethereum mainnet were batch-drained by the same address in a single day, with multiple wallets having shown no on-chain activity for over seven years.
Crypto user Capitulation subsequently suggested that the vulnerability likely traces back to users who stored seed phrases in LastPass's secure notes feature between 2020 and 2021. LastPass suffered a serious data breach in 2022, during which attackers obtained the contents of numerous password vaults—including encrypted seed phrase data belonging to crypto users.
The Time-Delay Attack: Breached in 2022, Harvested in 2026
This incident reveals one of the most insidious threat categories in crypto security: the time-delay attack. After obtaining leaked data, attackers do not act immediately. Instead, they spend years screening target wallets for value and working to decrypt the stolen data, launching a coordinated liquidation at the optimal moment.
For long-dormant wallets, users have typically stopped monitoring on-chain activity—giving attackers ample preparation time. Seven years of silence, under this attack model, is not safety. It is accumulated exposure.
Where Your Seed Phrase Lives Is Where Your Risk Lives
This incident delivers an unambiguous warning to all crypto users: the security of a seed phrase is determined by where it is stored, not by how much time has passed. Storing a seed phrase on any internet-connected device, cloud service, or password manager means that if the corresponding platform is compromised, control of your wallet is at risk.
Correct seed phrase management practices include: offline storage using physical media such as paper or metal plates; never saving seed phrases in any cloud service, whether in plaintext or encrypted form; regularly reviewing old wallets that have been inactive for extended periods and migrating assets to new addresses if necessary. If you stored a seed phrase in LastPass between 2020 and 2021, transfer the associated assets to a freshly generated wallet address immediately.