Blockchain analytics company Chainalysis said Wednesday night that some information belonging to all of its users was exposed in a cyberattack. Its website says its customers include law enforcement and national security organizations.
What Was Exposed
According to the company's latest update, the following was exposed to a malicious actor for all users:
- Names and usernames
- Password hashes
- Live tokens
Chainalysis has not said how many users it has, or whether every data category was exposed for every user. Some Know Your Transaction (KYT) accounts also appear to have been accessed. The company says it has no evidence that investigations data was accessed or that attribution data was manipulated.
How It Happened
Chainalysis first disclosed the incident on October 30. It said it detected an external actor using "offensive agentic techniques" to access its systems and internal tools. The company has not defined the phrase or said that an AI agent was responsible, although it linked the incident to an industry-wide rise in AI-driven attacks.
Some customers' passwords were also exposed in an on-path attack, where communications between users and the service are intercepted. The company says that method was contained and remediated. It is unclear whether the interception, the credential exposure and the account access share the same attacker or methods, and the attacker has not been identified.
Company Response
- Engaged third-party cybersecurity experts
- Required all users to reset passwords and rotate API keys, and advised logging in directly rather than through emailed reset links
- Took KYT, address screening and its login page offline after "abnormal activity", following earlier shutdowns of Reactor and Data Solutions on Monday
- Planned to restore KYT and Address Screening on Thursday for customers whose IP addresses are allowlisted. No date was given for Reactor, Data Solutions or Chain (Beta)
What Customers Should Do
- Reset your password by navigating to the login page directly, not through emailed links.
- Rotate all API keys and revoke active tokens.
- Reuse of the same password elsewhere should be treated as compromised, so change it there too.
- Be alert to phishing that references the incident.
- Review account activity for unfamiliar access, especially on KYT accounts.