Chainalysis Says Cyberattack Exposed Password Hashes and Live Tokens for All Users
Key Takeaways
- •Chainalysis disclosed that a cyberattack exposed password hashes and live tokens for all of its users, expanding on its initial report that only user IDs, names, and email addresses were compromised.
- •The company's Oct. 30 notice had stated there was no evidence attackers accessed authentication credentials or session tokens, an assessment it has since revised in a Wednesday update.
- •A separate Wednesday update linked some exposed customer passwords to an on-path attack, which Chainalysis said it has contained and remediated by locking affected accounts and requiring password resets.
- •Chainalysis said it still has no evidence that attackers accessed its investigation data or manipulated its attribution data, which is used by crypto businesses and government agencies for compliance and investigative work.
- •The company did not specify whether each type of exposed information affected every user and declined to provide details beyond its published disclosure.
Blockchain analytics firm Chainalysis has disclosed that a recent cyberattack exposed a wider set of customer data than it initially reported, including password hashes and live tokens, revising an earlier assessment that described the intrusion as involving only non-sensitive customer information.
In an update to its incident notice published Wednesday, the company said the breach's impact was broader than its original assessment. Password hashes are one-way cryptographic representations of passwords, while live tokens are credentials that keep users logged in to a service.
“On Monday, we discovered certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor,” the blockchain analytics firm said in the update.
The company did not disclose whether each type of information was exposed for every user, and it declined to provide Cointelegraph with additional information beyond its published disclosure.
Chainalysis initially reported the intrusion on Oct. 30, saying at the time that it had exposed user IDs, names and email addresses, and that it found no evidence attackers had accessed authentication credentials or session tokens.
A separate Wednesday update stated that an “on-path attack” exposed some customers' passwords. On-path attacks involve an adversary intercepting traffic between two parties. The company said it had contained and remediated that attack vector and was locking affected accounts and requiring password resets.
Despite the broader exposure, Chainalysis said it still had no evidence that attackers accessed its investigation data or manipulated its attribution data. The firm's attribution work links cryptocurrency transactions to real-world entities, and its analysis is used by crypto businesses and government agencies in compliance and investigative work.
The Oct. 30 notice made no mention of exposed password hashes or live tokens. The company has published successive updates to its incident notice since first disclosing the intrusion.
