Technology and Scienceupdated 20m ago2 min read
Chainalysis Says Breach Exposed All Users’ Credentials, Password Hashes, And Live Tokens
6outlets comparedWhere the coverage agrees
3 Western Mainstream2 Other1 Western AlternativeThis article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Hackers accessed names, usernames, password hashes, and live tokens for all Chainalysis users. The breach forced key services offline and prompted mandatory password resets across customers.
Save coverage image
6 outlets in this story. Read their headlines below.
All Users Affected
Chainalysis said hackers obtained sensitive personal information, including names, usernames, password hashes, and live tokens, for all of its users following a breach of its network security. Chainalysis told affected customers that some “non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform were accessed.”
Chainalysis later said an “on-path attack” exposed a subset of customer passwords, and the company said the attack vector had been identified and fixed. Chainalysis said it had taken the login portal offline along with Reactor and Data Solutions, the Know-Your-Transaction user interface and API, and address screening products after discovering further abnormal activity.
Agentic Techniques and Disruption
Chainalysis said an external actor used AI agent-assisted offensive techniques to gain unauthorized access to Chainalysis systems and internal tools. Chainalysis said it was probing an “ongoing multifront cyberattack” and then discovered an “on-path attack” that exposed a subset of customer passwords.
Chainalysis said it locked impacted accounts as a precaution and told customers that resetting passwords would not be possible right now for those who had just received an email instructing them to reset their Chainalysis password. Chainalysis said it intended to begin restoring access to KYT and Address Screening and urged customers to contact support@chainalysis.com or their Chainalysis account team with trusted IP addresses for an allowlist.
What Was Not Accessed
Chainalysis said it had no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated. Chainalysis said it had not found evidence that attackers had accessed investigation content, authentication credentials, or session tokens during its initial investigation.
Chainalysis said it had engaged “world-class third-party cybersecurity experts” to help investigate the incident and strengthen its defenses. Chainalysis warned that all users were hit in a cyber breach involving “agentic” techniques, while it did not identify the perpetrator and did not explain what it meant by “offensive agentic techniques.”