Blockchain analytics firm Chainalysis has confirmed that hackers exposed password hashes and live tokens belonging to its users during a cyberattack that forced several of its investigation and transaction monitoring services offline.
Summary
- Chainalysis confirmed that customer names, usernames, password hashes and live tokens belonging to all users were exposed to a malicious actor during a cyberattack.
- The company took KYT, Reactor, Data Solutions and other screening products offline after detecting suspicious activity, with some customer accounts potentially accessed without authorization.
- Chainalysis identified an on path attack that exposed a subset of customer passwords and said the attack method had since been contained and remediated.
- Customers will be required to reset passwords and rotate API keys where appropriate, while Chainalysis works to restore access through approved IP addresses.
According to a November 4 security update, the company discovered that customer information, including names, usernames, password hashes and live tokens for all Chainalysis users, had been exposed to a malicious actor.
The latest disclosure expands on an October 30 statement in which Chainalysis initially reported that certain customer profile details had been accessed but said it had found no evidence of compromised authentication credentials or session tokens.
The company has since identified suspicious activity involving its Know Your Transaction (KYT) service and is contacting customers whose accounts appear to have been accessed without authorization.
Chainalysis said it continues to have no evidence that investigation data was accessed or that its blockchain attribution data was manipulated during the incident.
Chainalysis cyberattack exposes passwords and live tokens
The security incident was first disclosed on October 30 after Chainalysis detected an external attacker using what it described as “offensive agentic techniques” to gain unauthorized access to its systems and internal tools.
Its initial investigation identified exposed user IDs, email addresses, full names and organizational roles, while the company worked to determine which customer records had been affected.
By November 4, investigators had identified another attack method involving the interception of customer passwords.
In an email sent to certain affected users, Chainalysis described the incident as an “ongoing multifront cyberattack” and confirmed that an “on-path attack” had exposed a subset of customer passwords.
An on-path attack allows an intruder to intercept communications between a user and a service. Chainalysis said it had contained and remediated the attack method and was locking affected accounts as a precaution.
The exposure of password hashes and live tokens presents separate security concerns. Password hashes are stored representations of passwords, while active authentication tokens can potentially provide access to services without requiring users to enter their passwords again.
Chainalysis has not disclosed the hashing method used to protect passwords or specified the type of live tokens involved.
The company has brought in third-party cybersecurity specialists to investigate the intrusion and strengthen its systems, with large language models being used to support its internal security review.
Chainalysis suspends KYT and Reactor services after suspicious activity
The breach has forced Chainalysis to suspend several products used by cryptocurrency exchanges, financial institutions and law enforcement agencies.
On November 2, the company took Reactor and Data Solutions offline for additional security assessments while allowing its compliance transaction monitoring products to continue operating.
Reactor provides blockchain investigation tools, while Data Solutions supplies blockchain data used by customers for analysis and monitoring.
Two days later, abnormal activity prompted Chainalysis to suspend KYT’s user interface and API, other address screening products and its login page.
KYT helps cryptocurrency businesses monitor transactions for suspicious activity and potential money laundering. Its API allows customers to connect transaction screening directly to their existing systems.
Chainalysis said it intended to begin restoring KYT and Address Screening access on November 5, initially through an allowlist of trusted customer IP addresses.
Customers were instructed to contact their account teams or support staff with approved IP addresses before receiving access to reset passwords and rotate API keys.
Every user will be required to reset their password, with API key rotation required where appropriate. The company has not provided a restoration date for Reactor or Data Solutions.
Recent crypto attacks put security controls under scrutiny
The incident follows several major cybersecurity breaches affecting cryptocurrency companies in recent weeks.
As crypto.news previously reported, Binance suffered an estimated $6.3 billion cryptocurrency theft on October 29 after attackers compromised systems connected to its wallet infrastructure.
Chainalysis explicitly stated that its own security incident was unrelated to the Binance theft.
The blockchain analytics company has continued assisting other firms with security investigations during the disruption. Following the November 2 Mercado Bitcoin attack, Chainalysis said it helped coordinate the freezing of nearly $10 million in stolen cryptocurrency.
Separately, Binance revoked API keys associated with trading platform SignalPlus on November 5 after the third-party service reported a security incident.
SignalPlus subsequently acknowledged that some affected accounts lacked mandatory IP whitelisting, while Binance and Deribit disabled connected credentials as a precaution.
In its instructions to affected customers, Chainalysis warned users against following links in unsolicited password reset emails and advised anyone who reused their Chainalysis password elsewhere to change those credentials.
The company recommended two-factor authentication for organizations that had not enabled it and asked customers to report suspicious communications or account activity to their security teams.
