Chainalysis breach hits password hashes and live tokens for every user

Chainalysis will start flipping KYT and Address Screening back on Thursday, days after yanking a heap of products offline. Customers who want to register transactions again must first allowlist trusted IP addresses, then reset their passwords and rotate API keys. Reactor, Data Solutions and Chain (Beta) are still dark. Everyone on the platform will have to change passwords and API keys once Reactor and Data Solutions come back.

The scope is ugly: Chainalysis says hackers reached the names, usernames, password hashes and live tokens of all users on its platform. In its Oct. 30 notice, the firm said it had no evidence that investigation content, authentication credentials or session tokens were accessed, and a customer email ruled out access to clear-text passwords and MFA secrets. The original intrusion dates to October, when an external actor used what the company called “offensive agentic techniques” to get into its systems and internal tools, walking away with user IDs, full names, email addresses and organization role labels.

Chainalysis spotted the exposure on Nov. 2 and pulled Reactor and Data Solutions while it investigated, bringing in outside cybersecurity experts. Compliance transaction monitoring stayed online because customers lean on it to catch money laundering. On Nov. 4, some customers got emails saying their passwords had been exposed in an “on-path attack” — those accounts were locked, and users were told to reset through the normal login page and to ignore reset links in emails. Abnormal activity surfaced later that same day, so KYT went offline along with its user interface and API, other address screening products and the login page. Customers whose KYT accounts look like they were accessed without authorization are being notified directly.

Who cares? Police, government agencies, exchanges and banks run Chainalysis software to trace crypto and chase fraud, ransomware and money laundering. The company is telling customers to switch on two-factor authentication and watch for unsolicited password reset requests, and says it is reviewing platform security with the help of large language models.

Chainalysis says this mess is not connected to the roughly $6.3 billion Binance theft, the biggest crypto hack on record — Binance blamed a compromised laptop belonging to a DevOps engineer. Also on Oct. 30, Chainalysis posted on X that suspected North Korea-linked hacks made up almost 89% of crypto hack losses reported this year; back in 2021 that share was 15%. Cryptopolitan reported that hacking groups with ties to China have picked up ARTEX, an AI penetration testing framework built in China.