Chainalysis says a breach it disclosed on October 30 exposed names, usernames, password hashes and live tokens for all of its users. In its first notice, the blockchain analytics company said it had found “no evidence of unauthorized access to investigation content, authentication credentials, or session tokens.” That notice listed user IDs, full names, email addresses and organization role labels as accessed, and called them non-sensitive.
The wider exposure appears in a November 4 update to its incident page, which says Chainalysis discovered it on November 2. A November 2 update said the company had taken its Reactor investigation platform and its Data Solutions product offline. It kept its compliance transaction-monitoring products running, citing their role in detecting money laundering.
On the morning of November 4, Chainalysis emailed certain customers that an “on-path attack” had exposed a subset of customer passwords, and said it was locking their accounts. It then reported “abnormal activity” and took offline KYT, its transaction-monitoring product, including the interface and API, along with other address screening products and the login page. Customers told to reset their passwords could not do so while the page was down. That night, it said it was directly notifying customers whose KYT accounts “appear to have been accessed without authorization.”
Early on November 6, the company said it had begun restoring KYT and Address Screening in phases. Customers must submit trusted IP addresses for an allowlist, and all users must reset passwords and rotate API keys, as applicable, before registering transactions. Reactor and Data Solutions remained offline as of that update, while the company worked with outside security experts.
Chainalysis says it has “no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated.” Its notices do not say who carried out the attack, how the on-path attack worked, which hashing method protected the passwords, what the live tokens could access or what the “offensive agentic techniques” it cited on October 30 involved. Its November 4 email to customers calls the incident an “ongoing multifront cyberattack.” The October 30 notice said it was “similar to many other tech platforms in recent weeks.”
The company’s customers include law enforcement and government agencies, financial institutions, insurers and crypto businesses. Reactor is used to trace crypto in investigations, and KYT is used for anti-money-laundering screening.
Chainalysis has said the incident is unrelated to the theft at Binance, which it has been analyzing publicly. Its October 30 email cited “an industry-wide rise in AI-driven cyberattacks.”
Sources: Chainalysis, The Register, BleepingComputer
–
By the Control Plane Editorial Team