Blockchain analytics company Chainalysis said late on Wednesday, November 4 (US Eastern time), that a breach it first disclosed on October 30 was worse than it had told customers. In its latest update, the company says “certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor.” On October 30 it had said it found no evidence that authentication credentials or session tokens were accessed. The Record notes that Chainalysis did not explain what it means by “live tokens” or how the exposed passwords were hashed. Some password hashes can be cracked, and active tokens can let an attacker into an account without a password.
Chainalysis says it still has no evidence that investigations data was accessed or that its attribution data was manipulated. It also says some customers’ accounts on its Know Your Transaction (KYT) service appear to have been accessed without authorization and that it is notifying those customers directly. The attacker has not been identified. Chainalysis originally described an “external actor using offensive agentic techniques” and called the incident “similar to many other tech platforms in recent weeks”; as The Record points out, it has not said whether an AI agent actually carried out the attack. Separately, the company told some customers their passwords were exposed in an “on-path attack,” in which an attacker intercepts traffic between users and a service, and said that method has been contained.
The disruption is broad. Chainalysis took Reactor and Data Solutions offline earlier this week, and on Wednesday it also took KYT (the interface and API), its address screening products and its login page offline after spotting abnormal activity. It said it intended to begin restoring KYT and Address Screening on Thursday. For KYT and Address Screening, customers must first send trusted IP addresses for an allowlist before they can reset passwords and rotate API keys. For comparison, other recent breaches attributed to AI-driven attackers are covered in our post on Chainstack and WorkOS; Chainalysis has not said whether any of them are linked.
How to check if you’re affected
Affected products are Chainalysis accounts of any kind: the company says the exposure covers all users, so assume your account is included if you have one. Chainalysis lists these steps:
- Every user will have to reset their password and rotate API keys as appropriate once access is restored. Chainalysis ties the API-key rotation to registering transactions with KYT.
- Go directly to the Chainalysis login page. Chainalysis tells customers not to click links in any password-reset emails they received. Resetting is not possible while the login page is offline.
- If you used the same password anywhere else, change it there too and choose a unique one. Chainalysis recommends this for other systems.
- Stay alert for suspicious messages and report concerns to your IT or security team, as Chainalysis advised on November 2.
Chainalysis says to contact its account team or the contact address on its incident page if you need help getting back in.