Chainalysis confirmed that an attacker exposed customer names, usernames, password hashes and live tokens for all its users. The company took several investigation and screening products offline and is requiring password resets.
Blockchain analytics firm Chainalysis confirmed that hackers exposed password hashes and live tokens belonging to its users during a cyberattack. The attack forced several of its investigation and transaction monitoring services offline.
According to a November 4 security update, the company discovered that names, usernames, password hashes and live tokens for all users had been exposed to a malicious actor. That disclosure expands on an October 30 statement, in which Chainalysis reported no evidence of compromised authentication credentials or session tokens.
An on-path attack exposed customer passwords
Chainalysis first disclosed the incident on October 30, saying an external attacker used offensive agentic techniques to gain unauthorized access to its systems and internal tools. By November 4, investigators had identified another method involving the interception of customer passwords.
In an email to certain affected users, the company described an on-path attack that exposed a subset of customer passwords. It said it had contained and remediated that method and was locking affected accounts as a precaution. Chainalysis has not disclosed the hashing method used to protect passwords or specified the type of live tokens involved.
KYT and Reactor go offline
On November 2, Chainalysis took Reactor and Data Solutions offline for additional security assessments, while its compliance transaction monitoring products kept running. Two days later, abnormal activity led it to suspend the KYT user interface and API, other address screening products and its login page.
KYT helps crypto businesses monitor transactions for suspicious activity and potential money laundering. Chainalysis said it intended to begin restoring KYT and Address Screening access on November 5, initially through an allowlist of trusted customer IP addresses. It has not provided a restoration date for Reactor or Data Solutions.
Customers must reset passwords
Every user must reset their password, and API keys must be rotated where appropriate. Chainalysis also warned users against following links in unsolicited password reset emails and advised anyone who reused their password elsewhere to change it.
Chainalysis said its incident was unrelated to the Binance theft reported on October 29. The company said it continues to have no evidence that investigation data was accessed or that its blockchain attribution data was manipulated.
Sources: crypto.news, Chainalysis
Trading involves risk.
Risk Disclaimer
