TRM Labs has identified Russian cybercrime groups as the culprits behind the laundering of stolen crypto assets from the 2022 LastPass breach. Despite the use of mixing tools like CoinJoin, TRM's analysis traced the fund flows to the same group of attackers. The stolen assets, estimated at over $28 million, were funneled into high-risk Russian exchanges Cryptex and Audi6, according to on-chain evidence.