Chainalysis has disclosed that hackers gained access to the names, usernames, password hashes and live tokens of all users on its platform. Password hashes are one-way scrambled versions of passwords rather than the passwords themselves, while live tokens are active session credentials that can grant access to an account without a password being entered. The blockchain analytics firm had said in an official security incident notice published on Oct. 30 that it had no evidence credentials were touched.

The company detected the exposure on Monday and pulled its Reactor and Data Solutions products offline while it investigated. It said it still has no evidence that investigation data was accessed or that its attribution data was manipulated.

Live tokens leaked after an earlier notice ruled out credentials

In October, an external actor used "offensive agentic techniques," a phrase referring to attack methods carried out by AI agents, to access Chainalysis systems and internal tools, obtaining user IDs, full names, email addresses and organization role labels. The Oct. 30 notice found "no evidence of unauthorized access to investigation content, authentication credentials, or session tokens," and an attached customer email also ruled out access to clear-text passwords and MFA secrets.

Chainalysis software is used by police, government agencies, exchanges and banks to track crypto activity and pursue fraud, ransomware and money laundering.

KYT and login page taken offline after abnormal activity

On Monday, Nov. 2, Chainalysis took Reactor and Data Solutions offline and hired outside cybersecurity experts to assist with the response. Its KYT compliance transaction monitoring, which customers depend on to detect money laundering, remained online at that stage.

On Nov. 4, the company emailed some customers to inform them that some of their passwords had been exposed in an "on-path attack," in which an attacker intercepts traffic between a user and the service they are connecting to. It locked the affected accounts and instructed users to reset their passwords on the normal login page, warning them not to click any links in emails claiming a password reset was required.

Later that day, Chainalysis reported abnormal activity. It took KYT offline, including the user interface and API, along with other address screening products and its login page. Reactor, Data Solutions and Chain (Beta) remained down. Customers whose KYT accounts appear to have been accessed without authorization are being directly notified.

On Thursday, Chainalysis will begin bringing KYT and Address Screening back online. To register transactions again, customers must first add trusted IP addresses to an allowlist that limits access to approved network addresses, then reset their passwords and rotate their API keys. All users will be required to change their passwords and API keys once Reactor and Data Solutions are back online. As part of a broader review of its platform security, the company is using large language models.

Cryptopolitan has reported that hacking groups with ties to China have adopted ARTEX, an AI penetration testing framework developed in China.

Chainalysis says the breach is not related to the ~$6.3 billion Binance theft, the largest crypto hack on record. Binance has said a compromised laptop belonging to a DevOps engineer was linked to that theft.

In a post on X on Oct. 30, Chainalysis said suspected North Korea-linked hacks accounted for almost 89% of all crypto hack losses reported this year, up from a 15% share in 2021.

The blockchain analytics company has advised customers to activate two-factor authentication and remain alert to unsolicited password reset requests.