Chainalysis says breach exposed password hashes and live tokens for all users

What happened

Chainalysis has widened its account of a cyberattack, saying that names, usernames, password hashes and live tokens for all of its users were exposed to a malicious actor. The blockchain analytics firm said it made the discovery on Monday and published the update on Wednesday, according to Cointelegraph and Bitcoin.com News.

The disclosure marks a significant escalation from the company's first notice on Oct. 30, when it said user IDs, names and email addresses had been accessed and that it had found no evidence that authentication credentials or session tokens were compromised. In a separate update on Wednesday, Chainalysis said an "on-path attack" had exposed some customers' passwords; it said that vector had been contained and remediated, and that affected accounts were being locked pending password resets.

In response, Chainalysis took several services offline, including its Know Your Transaction monitoring platform and its user interface and API, address screening products and its login page. The Reactor investigation platform, Data Solutions products and the Chain (Beta) service were also shut down, Bitcoin.com News reported. The company said it detected abnormal activity in its transaction screening systems after adding monitoring measures and is directly notifying customers whose KYT accounts appear to have been accessed without authorization.

Chainalysis said it plans to restore KYT and Address Screening access using a system that requires customers to supply trusted IP addresses for an allowlist, after which users can reset passwords and rotate API keys. The company said all users will be required to reset passwords and rotate keys where appropriate. It did not say whether every type of data was exposed for every user and declined to give Cointelegraph more detail beyond its published notice.