Chainalysis has confirmed that the attack on its systems exposed names, usernames, password hashes and live authentication tokens belonging to all of its users. The update, published on November 6, reverses the company's initial assessment, from October 30, that credentials and session tokens had not been accessed.
The blockchain intelligence firm serves law enforcement agencies, government bodies, financial institutions and cryptocurrency companies worldwide, with tools to trace transactions and investigate fraud, ransomware and money laundering.
What changed since the first disclosure
On October 30, Chainalysis said an attacker had accessed its systems and internal tools using what it described as "offensive agentic techniques". At the time, the company said names, email addresses, user IDs and organizational role labels had been accessed — data it described as non-sensitive.
On Monday, November 2, the company discovered the exposure was broader: names, usernames, password hashes and live tokens for all users had been exposed to a malicious actor. The same day, as a precaution, it took Reactor and Data Solutions, its investigation tools, offline.
On November 4, after detecting abnormal activity, the company also took its login portal, the Know-Your-Transaction (KYT) interface and API, address-screening products and other services offline. That evening, it told customers about the full exposure.
On November 6, Chainalysis began restoring KYT and address screening in phases. Reactor and Data Solutions remained offline, with no timeline given for their return.
What customers need to do
To regain access, customers must submit trusted IP addresses for an allowlist. Once access is granted, every user will have to reset their password and rotate API keys, where applicable, before registering transactions. The company is also directly notifying customers whose KYT accounts appear to have been accessed without authorization.
A live token is a valid session credential: with it, an attacker can act as a signed-in user without knowing the password. The company therefore advises resetting passwords on other systems where the same credentials may have been reused.
What the company says was not affected
According to Chainalysis, there is still no evidence that investigation data was accessed or that attribution data — which links blockchain addresses to real-world entities — was manipulated. The investigation continues with the help of outside security experts.
The disclosure comes amid a series of security incidents involving cryptocurrency companies. Most recently, exchange Binance said North Korean hackers stole about $6.34 billion in cryptocurrency after compromising its wallet infrastructure.
Read also: Chainalysis confirms breach using “offensive agentic techniques”, exposing customer names and emails — our coverage of the initial disclosure, from November 1.
Image credit: Chainalysis publicity image, via the company's official press resources page.
Fontes
- BleepingComputer — Chainalysis says breach exposed credentials for all customers
- Bitcoin Insider — Chainalysis Breach Widens to All Users' Password Hashes as KYT Restarts in Phases
- CryptoTimes — Chainalysis Confirms Password and Token Exposure After Cyberattack
Transparency: this article was produced with the help of artificial intelligence, with research and cross-checking of public sources on the internet and posts on social media. The facts were verified against the cited sources; consult the original sources to check the details.
By Muse
