Chainalysis Says Hackers Exposed Credentials for All of Its Users
Blockchain analytics firm Chainalysis widened its breach disclosure, saying password hashes and live tokens for every user were exposed and taking products offline.
Chainalysis, a company whose software helps police, regulators and banks trace cryptocurrency, has said that hackers exposed the names, usernames, password hashes and live tokens of every one of its users. The disclosure is a sharp reversal from its first notice a week earlier, which described the intrusion as limited to basic, non-sensitive contact details. The company has since taken several of its main products offline and is making customers register trusted internet addresses before they can log back in.
What happened
Chainalysis first disclosed the incident on Friday, Oct. 30, in a notice to customers that it also posted on its blog. The company said an unidentified outside actor had used what it called “offensive agentic techniques” to break into its systems and internal tools. At the time, it said the intruder had accessed “user IDs, full names, email addresses, and organization role labels.” According to The Block, the company said then that it had found no evidence of access to investigation content, clear-text passwords, multifactor authentication secrets or session tokens.
That picture changed over the following days. BleepingComputer reported that, according to a later Chainalysis update, the company discovered on Monday, Nov. 2, that more sensitive information had been exposed. An update on Wednesday, Nov. 4, said an “on-path attack”, a technique in which an attacker intercepts traffic between a user and a service, had exposed a subset of customer passwords. Later that day, Chainalysis said that names, usernames, password hashes and live tokens had been exposed for all of its users.
In a customer email, the company described the incident as “an ongoing multifront cyberattack” and said one of the attack methods had been “contained and remediated,” American Banker reported. A Chainalysis spokesperson told the trade publication that the company was “not sharing additional information beyond what has been published in the blog.”
Chainalysis has said it has no evidence that its investigations data was accessed or that its attribution data, which links crypto addresses to the people and companies behind them, was tampered with. Both outlets noted that “no evidence” reflects what the company’s investigation has found so far.
Products taken offline
As a precaution, Chainalysis locked accounts and asked users to reset passwords. After it detected what it called further abnormal activity, it pulled several services offline, according to BleepingComputer and American Banker:
- Reactor, its investigations tool for following stolen or illicit funds.
- Data Solutions, which feeds blockchain data into customers’ own systems.
- KYT, short for Know Your Transaction, a monitoring tool that compliance teams use to flag suspicious crypto transfers, along with its API.
- Address screening products and the customer login portal.
American Banker reported that Chainalysis initially kept KYT running after taking Reactor down, citing its role in detecting money laundering, before switching it off as well. To regain access, customers must send trusted IP addresses to the company so they can be placed on an allowlist, then reset passwords and replace their API keys. A further update on Friday, Nov. 6, said all users would have to take those steps once access returns. American Banker said the company had given no return date for Reactor or Data Solutions.
Why it matters
Chainalysis is one of the best-known names in blockchain analytics. Its tools are used to investigate fraud, ransomware and money laundering, and its customers include law enforcement, government agencies, financial institutions, insurers and crypto businesses, according to BleepingComputer. The company says it has more than 1,500 customers in 70 countries, American Banker reported, noting that the bank BNY has said it integrated the firm’s full compliance suite. Neither BNY nor Lead Bank, another named customer, had responded to the publication’s requests for comment, and nothing published indicates whether any bank’s account was accessed.
The outage also comes at an awkward moment for the crypto industry. Days before KYT went offline, thieves stole roughly $6.4 billion from the exchange Binance, a theft that Chainalysis and rival analytics firms have attributed to North Korean hacking groups. Chainalysis said its own breach is “not related to the recent crypto theft at Binance,” according to The Block. American Banker noted that the Binance thieves need a counterparty, such as a centralized exchange, to cash out, which is where monitoring tools like KYT are meant to catch them.
The case is also likely to draw attention to the use of AI agents in attacks. “Agentic” usually refers to AI software that carries out multistep tasks on its own, but American Banker pointed out that Chainalysis’s email did not say AI drove the attack.
What comes next
Many questions remain unanswered. The company has not said how the attackers first got in, how long they had access, how many KYT accounts were reached, what kind of live tokens were exposed or whether any stolen credentials have been misused. The Block reported that Chainalysis declined its follow-up questions and said it would send each client a detailed account of what information was accessed. The company said it has brought in outside cybersecurity experts to help with its investigation.
