Chainalysis says the breach exposed every one of its users
The blockchain analytics firm went from saying it had found no stolen credentials to acknowledging that password hashes and live tokens were within an attacker's reach.
Every Chainalysis user was exposed to a malicious actor, the company says in its incident notice, updated Wednesday night. Names, usernames, password hashes and live tokens were involved. A hash is a password scrambled into a fixed string; a live token is the temporary key that keeps a login session open.
Chainalysis sells blockchain analytics and compliance software to exchanges, banks and law enforcement. For those customers, a stolen token is an open door to their account and their API key.
The scope grew over five days. On Oct. 30 the company said it had found no sign that credentials or session tokens were reached, and acknowledged only items such as full names, emails and organization roles. On Wednesday it said an "on-path" attack, which intercepts traffic between user and server, had exposed the passwords of some customers. Hours later it said the problem reached everyone.
Its transaction-monitoring tool, KYT, went offline Wednesday along with address screening and the login page. Reactor and Data Solutions have been down since Nov. 2. The company says it has no evidence that investigations data was accessed or that attribution data was tampered with.
Chainalysis is asking customers to send trusted IP addresses for an allowlist, reset passwords through the official login page rather than email links, rotate API keys, change any reused password elsewhere and turn on two-factor authentication. It says it is notifying KYT accounts that appear to have been accessed without authorization.
All of this is the company's own account. There is no independent check of the scope, and Chainalysis has not said how many organizations were accessed or how the attacker got in, beyond describing "offensive agentic techniques." Nothing indicates Mexican customers were affected.
KYT and address screening began coming back in stages on Friday. Reactor and Data Solutions stay offline while outside specialists harden them, with no return date.
