Blockchain Analytics Firm Reports Security Incident Affecting All Accounts
Chainalysis, a blockchain analytics company serving law enforcement and financial institutions, announced that credential data for every user account was exposed in a cyberattack. The company initially disclosed the incident on October 30 but said Wednesday night that password hashes and active authentication tokens for all users had been accessed. Some users also faced password interception through an on-path attack, and certain accounts on the firm's transaction monitoring service appeared to have been accessed. Chainalysis shut down most customer-facing systems while it investigates.
What Was Exposed in the Breach
According to the company's Wednesday statement, the exposed information includes names, usernames, password hashes and live tokens for all Chainalysis users. The company has not specified what hashing algorithm was used. The statement did not clarify whether every category of information was exposed for every user or how many users the company has.
Chainalysis also reported that some users had passwords exposed through an on-path attack, in which an attacker intercepts communications between the user and the service. The company said this interception method had been contained and that affected accounts were being locked. It stated there was no evidence they had been accessed improperly.
Suspected Account Access on Transaction Monitoring Service
The company said that some customer accounts on its Know Your Transaction service appeared to have been accessed. KYT is used to monitor cryptocurrency transactions for suspicious activity. Chainalysis did not say how many accounts showed signs of access or what data those accounts contained.
The company stated it continues to have no evidence that investigations data has been accessed or attribution data has been manipulated. Chainalysis provides transaction tracing and address attribution services to law enforcement agencies. Its website says it serves more than 1,500 customers across law enforcement, cryptocurrency, finance, regulators and national security sectors.
Offensive Agentic Techniques Referenced but Not Explained
Chainalysis said it had detected an external actor using offensive agentic techniques to gain unauthorized access to systems and internal tools. The company has not explained what it meant by that term. In its initial disclosure, Chainalysis mentioned an industry-wide rise in AI-driven cyberattacks but did not explicitly say its own breach was caused by an AI agent.
An email to affected customers described an ongoing multifront cyberattack but did not identify the other fronts. Chainalysis has not specified whether multiple methods, attackers or components link the password interception, token exposure and suspected account access.
Service Shutdowns and Restoration Plan
Chainalysis took its KYT user interface and API, address-screening products and login page offline Wednesday night after detecting abnormal activity. Earlier this week, the company had disabled its Reactor investigations tool and Data Solutions product as a precaution while leaving compliance transaction-monitoring products running.
The company said it planned to begin restoring KYT and Address Screening after customers provide trusted IP addresses for an allowlist. Once that step is complete, customers will be able to reset passwords and rotate API keys. No timeline has been given for restoring Reactor, Data Solutions or another product, and the company did not explain how customers were screening transactions while KYT was offline.
Password Reset Instructions and Phishing Warning
All users will have to reset their passwords and rotate API keys as appropriate, the company said. Chainalysis urged affected customers to visit its login page directly rather than follow links in password-reset emails. Customers who had just been instructed to reset their passwords were told doing so was not immediately possible because the login page was offline.
The company did not define what it meant by live tokens or state which hashing method was used for the exposed passwords. Depending on the algorithm, password hashes may be cracked to reveal the original plaintext. Active authentication tokens can let an attacker access an account without needing the password at all.
Steps Users Should Take
Users should reset their passwords and rotate API keys once the login page is restored. Organizations that integrate Chainalysis APIs should rotate keys. Users should check whether they have reused their Chainalysis password on other services and change it there as well.
- Visit the Chainalysis login page directly rather than clicking links in emails
- Reset your password once the login page is restored
- Rotate API keys as appropriate for your account
- Check if you reused your Chainalysis password elsewhere and change it
Questions readers ask
What is Chainalysis and who uses it?
Chainalysis is a blockchain analytics company that provides cryptocurrency transaction tracing and monitoring tools. Its website says it serves more than 1,500 customers across sectors including law enforcement, cryptocurrency, finance, regulators and national security.
What information was exposed in the Chainalysis breach?
The company said names, usernames, password hashes and live tokens for all Chainalysis users were exposed. Some users also had passwords exposed through an on-path attack. The company has not specified the hashing method or clarified whether every category was exposed for every user.
What are offensive agentic techniques?
Chainalysis used this term to describe the attacker's methods but has not explained what it means. The company mentioned an industry-wide rise in AI-driven cyberattacks but did not explicitly say its own breach was caused by an AI agent.
Can attackers access Chainalysis accounts with the stolen tokens?
The company said live tokens were exposed but did not explain what it meant by that term. Active authentication tokens may allow attackers to access accounts without passwords if the tokens remain valid. Chainalysis has shut down most services and plans to require password resets and API key rotation.
When will Chainalysis services be restored?
The company said it planned to begin restoring KYT and Address Screening after customers submit trusted IP addresses for an allowlist. It gave no date for restoring Reactor, Data Solutions or its Chain product.
Source and reporting limits
Based on reporting by The Record. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.