Science & Tech · Cybersecurity · 1 hr ago
Chainalysis says cyberattack exposed user details, password hashes and tokens
Chainalysis says attackers accessed information belonging to its users in a cyberattack disclosed on October 30.
The company provides blockchain analysis tools to customers including law enforcement agencies, financial institutions and crypto businesses.
Its latest update said names, usernames, password hashes and live authentication tokens were exposed, though it did not say whether every type of data was exposed for every user.
Password hashes may be vulnerable to cracking, while live tokens can potentially let attackers access accounts without passwords; Chainalysis did not explain what its tokens were or how the passwords were hashed.
The company said there is no evidence investigation data was accessed or altered.
It took several services offline after detecting abnormal activity, including tools used to investigate blockchain activity and monitor crypto transactions for suspicious activity.
Chainalysis said it planned to restore some services after customers provide trusted IP addresses, and all users must reset passwords and rotate API keys where needed; it gave no date for restoring all affected services.
Chainalysis said information including names, usernames, password hashes and live tokens for its users was exposed in a cyberattack.
The company first disclosed the breach on October 30 and said it had detected an external actor using “offensive agentic techniques.”
Chainalysis took several services offline after detecting abnormal activity, including its Reactor investigation platform, Data Solutions and parts of its KYT service.
The company said it had no evidence that investigation data was accessed or its attribution data manipulated.
Chainalysis said users would have to reset passwords and rotate API keys as appropriate, and planned to begin restoring some services on Thursday.
- Who
- Chainalysis and its users were affected. The attacker was not identified.
- What
- A cyberattack exposed user information, including password hashes and live tokens. Some customers’ KYT accounts appeared to have been accessed.
- When
- Chainalysis detected the intrusion on October 30. It disclosed the exposure of password hashes and live tokens in an update on Wednesday night.
- Where
- Chainalysis’s systems and internal tools. A physical location was not stated.
- Why
- The attacker’s motive was not stated. Chainalysis took services offline after detecting abnormal activity and as a precaution.
This story does not have two clearly opposing sides.
Chainalysis said it detected an external actor using offensive agentic techniques to access its systems and internal tools.
The company took its Reactor investigations tool and Data Solutions offline as a precaution.
Chainalysis said names, usernames, password hashes and live tokens for its users had been exposed.
The company took KYT’s user interface and API, other address-screening products and its login page offline after detecting abnormal activity.
Chainalysis planned to begin restoring KYT and Address Screening after customers submitted trusted IP addresses for an allowlist.
- Information exposed
- Names, usernames, password hashes and live tokens
- Initial breach disclosure
- October 30
- Products taken offline
- Reactor, Data Solutions, KYT user interface and API, and address-screening products
- Planned restoration
- KYT and Address Screening on Thursday
- Customers
- More than 1,500, according to Chainalysis’s website
3 sources
What people are saying
At this time we continue to have no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated
We are working around the clock to harden our systems and bring Reactor and Data Solutions back online
We know how business-critical these services are to our customers, and we are working expeditiously alongside our outside experts to restore them securely.