Blockchain analytics firm Chainalysis has confirmed that hackers exposed password hashes and live tokens belonging to all users during a cyberattack that forced several monitoring services offline. According to its latest Wednesday night update, the company discovered that customer names, usernames, password hashes and live tokens for all Chainalysis users had been exposed to a malicious actor. The company initially disclosed the breach on October 30, but at the time reported finding no evidence that authentication credentials or session tokens had been accessed. However, in its latest update, Chainalysis revealed it had "detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools." The company has not explained what it meant by "offensive agentic techniques" and did not specify whether every category of information was exposed for every user.
The breach has forced Chainalysis to suspend several products used by cryptocurrency exchanges, financial institutions and law enforcement agencies. On November 2, the company took Reactor and Data Solutions offline for additional security assessments while allowing its compliance transaction monitoring products to continue operating. Forty minutes later on Wednesday night, abnormal activity prompted Chainalysis to suspend KYT's user interface and API, other address screening products and its login page. The company initially told customers the breach came amid "an industry-wide rise in AI-driven cyberattacks" but did not explicitly say its own breach was caused by an AI agent. Chainalysis said it planned to begin restoring KYT and Address Screening on Thursday, after customers submitted trusted IP addresses to be added to an allowlist.
Chainalysis identified an on-path attack that exposed a subset of customer passwords, allowing an intruder to intercept communications between users and the service. The company said it had contained and remediated the attack method and was locking affected accounts as a precaution. The exposure of password hashes and live tokens presents separate security concerns, as password hashes are stored representations of passwords while active authentication tokens can potentially provide access without requiring users to enter passwords again. The company said it had "engaged world-class third-party cybersecurity experts" to help investigate the incident and strengthen its defenses, though it did not specify how many users it serves.
Customers will be required to reset passwords and rotate API keys where appropriate, while Chainalysis works to restore access through approved IP addresses. In instructions to affected customers, the company warned users against following links in unsolicited password reset emails and advised anyone who reused their Chainalysis password elsewhere to change those credentials. The company recommended two-factor authentication for organizations that had not enabled it and asked customers to report suspicious communications or account activity to their security teams. Customers who had just been instructed to reset their passwords were told doing so was not immediately possible during the service disruptions.
The incident follows several major cybersecurity breaches affecting cryptocurrency companies in recent weeks, including Binance's estimated $6.3 billion cryptocurrency theft on October 29. Chainalysis explicitly stated that its own security incident was unrelated to the Binance theft. The blockchain analytics company has continued assisting other firms with security investigations during the disruption, following the November 2 Mercado Bitcoin attack where it helped coordinate the freezing of nearly $10 million in stolen cryptocurrency. Chainalysis said it had "no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated" during the breach.
