Chainalysis reveals that a cyberattack exposed password hashes, live tokens, and some customer passwords, prompting mandatory security resets.

Table of contents

  • Chainalysis confirmed that hackers exposed user password hashes and live authentication tokens in a security breach first disclosed on October 30
  • The blockchain analytics firm suspended access to several products, including Reactor, Data Solutions and KYT, after detecting unauthorized access and suspicious customer account activity
  • Chainalysis is requiring password resets and API key rotations while investigating the breach, but says there is no evidence that investigation records or blockchain attribution data were compromised

Chainalysis has confirmed that hackers accessed password hashes and live authentication tokens belonging to all users of its platform, expanding the scope of the late October cybersecurity breach. The blockchain analytics company also detected suspicious activity involving customer accounts and suspended several services as it works to contain the incident.

Chainalysis reveals wider scope of security breach

In an updated security disclosure, Chainalysis said a malicious actor had accessed information including users' names, usernames, password hashes, and live tokens. The company initially said it had found no evidence that authentication credentials or session tokens were compromised.

The incident began when Chainalysis detected an external actor using what it described as "offensive agentic techniques" to gain unauthorized access to its systems and internal tools.

Its previous disclosure identified exposed customer information, including user IDs, full names, email addresses, and organizational roles. However, the company said its initial investigation had found no evidence that passwords, multifactor authentication secrets or session tokens were accessed.

Chainalysis also identified an on-path attack that intercepted passwords belonging to a subset of customers. An on-path attack occurs when an attacker intercepts communications between a user and a service.

The company said it had contained and remediated the attack method and was locking affected accounts. It also detected abnormal activity involving its Know Your Transaction (KYT) service and began notifying customers whose accounts appeared to have been accessed without authorization.

Source: Chainalysis

However, Chainalysis has not disclosed the number of affected customers, the hashing method used to protect passwords, or the specific types of live authentication tokens exposed.

Chainalysis takes investigation and monitoring tools offline

The security incident has disrupted several Chainalysis products used by cryptocurrency exchanges, financial institutions and law enforcement agencies.

On November 2, the company took its Reactor investigation platform and Data Solutions offline while conducting additional security assessments. It initially kept its compliance transaction monitoring products operational. However, subsequent findings prompted further restrictions.

Chainalysis later suspended the KYT user interface and API, additional address-screening products, and its login page after detecting abnormal activity.

KYT allows cryptocurrency businesses to monitor transactions for suspicious activity, including potential money laundering and exposure to sanctioned entities. Reactor provides blockchain investigation tools used to trace cryptocurrency transactions and investigate illicit fund movements.

The company said it planned to restore KYT and Address Screening access through an allowlist of trusted customer IP addresses. Customers would need to provide approved IP addresses before regaining access. However, Chainalysis has not provided a definitive restoration date for Reactor and Data Solutions.

Chainalysis is requiring users to reset their passwords and rotate API keys where appropriate as part of its response. The company has also advised customers to enable two-factor authentication and remain alert to suspicious password reset requests and authentication prompts.

Aliyu Pokima is an accomplished journalist with a keen focus on cryptocurrencies and emerging technology. He has over five years of active newsroom experience under his belt, honing his craft across leading publications in the industry. His work focuses on macro trends, digital asset policies, and breaking Web 3 stories. When he's not poring over charts and following leads, he spends time volunteering and reading fiction.