Chainalysis Attack More Serious Than Expected: User Password Hashes and Active Tokens Leaked

Chainalysis, one of the most recognized companies in transaction analysis within blockchain networks, is dealing with the aftermath of a cyberattack detected on October 30. As a result of the incident, user data was exposed, including hashed passwords and active tokens. Some of the company's services have been temporarily disabled.

In an update published on November 4, Chainalysis reported that the leaked information included names, usernames, password hashes, and active tokens. The company did not specify whether all the mentioned types of data pertained to every affected user.

Initial reports about the incident, communicated on October 30, indicated that user identifiers, names, email addresses, and information about roles assigned to accounts in organizations using the platform were disclosed. At that time, the company stated that it had found no evidence of credential or session token theft. However, a subsequent update revealed a significantly larger scale of the breach.

Chainalysis also reported that a separate on-path attack led to the exposure of passwords for some clients. This type of attack involves intercepting or interfering with communication between the user and the service. The company announced that it had secured this attack vector, blocked accounts that may have been affected by the incident, and enforced password changes.

However, it did not disclose what algorithm was used to create the hashes or what types of active tokens were compromised. It is also unclear whether each type of information was disclosed for every user. It is important to note that a hash is not a password stored in plain text. Its security depends, among other factors, on the algorithm and cryptographic parameters used.

Chainalysis is one of the key providers of solutions used to investigate cryptocurrency flows and identify activities within blockchain networks.

Some Services Have Been Disabled

On November 4, the company reported detecting anomalies that prompted it to temporarily disable additional services. The Know Your Transaction (KYT) interface and API, the Address Screening tool, and the login page became unavailable. Earlier, on November 2, Reactor and Data Solutions were also disabled for additional security checks.

Chainalysis stated that some KYT accounts may have been used without authorization. The company directly contacted clients whose accounts may have been compromised. However, it did not provide evidence indicating that attackers gained access to investigative data or modified attribution information, which assigns specific addresses and activities in the blockchain to particular entities.

The company announced a phased restoration of access to KYT and Address Screening starting November 5. The process was to include verification of trusted client IP addresses and adding them to an allowed connections list. After regaining access, users would be able to change passwords and, in appropriate cases, renew API keys.

However, this did not mean that all services were restored. Reactor and Data Solutions remained unavailable as the company continued to work on securing the infrastructure and restoring their functionality.

Company Continues to Investigate Incident Circumstances

Chainalysis has not yet disclosed who is behind the attack or how exactly the security breach occurred. A detailed technical reconstruction of the entire incident has also not been provided.

Initial communications referenced techniques described as "offensive agentic techniques." However, this phrasing does not constitute evidence that the cyberattack was carried out by an autonomous artificial intelligence agent. The company did not elaborate on what tools the attackers used or what role AI solutions played in this process.

Chainalysis reported that it has engaged external cybersecurity experts. The company is also utilizing large language models to support a broader review of its platform's security.

The incident is particularly significant due to the nature of Chainalysis's operations. The company provides solutions used by financial institutions, cryptocurrency businesses, and law enforcement agencies to analyze transactions and detect suspicious activities. The exposure of client data and the temporary unavailability of parts of the infrastructure may therefore have consequences that extend beyond the company itself.

Chainalysis emphasizes that it has found no evidence of attackers accessing investigative data or manipulating attribution information. However, this does not mean that all potential consequences of the incident have been ruled out. Investigations and efforts to restore all services are still ongoing.

Details regarding the incident are published by the company in its official security breach notification.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.