Chainalysis widens scope of its breach: data and tokens of all its users exposed

The US company Chainalysis, whose tools are used to trace cryptocurrency transactions, said in an update posted on the night of November 4 (US Eastern time) that "names, usernames, password hashes and live tokens for all users" were exposed to a malicious actor, according to its incident page.

On October 30, Chainalysis attributed the incident to an external actor using "offensive agentic techniques" and said it had found no evidence of access to credentials or session tokens. On November 4 it also told a group of customers that an on-path attack had exposed some of their passwords, and it locked those accounts.

The company took Reactor and Data Solutions offline on November 2 and, on November 4, KYT (user interface and API), its address screening products and the login page. According to Chainalysis, there is still no evidence that investigations data was accessed or that its attribution data was manipulated.

Chainalysis said it would restore access to KYT and address screening in phases, with a list of trusted IP addresses per organization and a requirement for all users to change their password and rotate their API keys. CriptoNoticias reports that restoration began this Friday, November 6; the company had not confirmed this on its page at the time of checking. It has not been reported who is behind the attack.