diff --git a/docs/changes.txt b/docs/changes.txt
index 11542ec4c..2ca10fa6b 100644
--- a/docs/changes.txt
+++ b/docs/changes.txt
@@ -11,6 +11,12 @@
 - Added hash-mode: ENCsecurity Datavault (MD5/keychain)
 - Added hash-mode: Dahua NVR/DVR/HVR (md5($salt1.strtoupper(md5($salt2.$pass))))
 
+##
+## Bugs
+##
+
+- Fixed keys extraction in luks2hashcat - now extracts all active keys
+
 ##
 ## Technical
 ##
diff --git a/tools/luks2hashcat.py b/tools/luks2hashcat.py
index 16f4bc933..a2d63733d 100755
--- a/tools/luks2hashcat.py
+++ b/tools/luks2hashcat.py
@@ -273,8 +273,13 @@ def extract_version1(file):
     )
 
     # check for any active key
+    if all(key.active not in [KeyVersion1.Active.ENABLED, KeyVersion1.Active.ENABLED_OLD] for key in header.keys):
+        # all keys are disabled
+        raise ValueError("all keys are disabled")
+
     for key in header.keys:
         if key.active not in [KeyVersion1.Active.ENABLED, KeyVersion1.Active.ENABLED_OLD]:
+            # skip inactive keys
             continue
 
         hash = SIGNATURE + "$".join(
@@ -294,10 +299,6 @@ def extract_version1(file):
             )
         )
         print(hash)
-        break
-    else:
-        # all keys are disabled
-        raise ValueError("all keys are disabled")
 
 
 # main