Chainalysis says breach exposed credentials for all customers

Blockchain intelligence firm Chainalysis says a recent attack on its systems and internal tools has exposed credentials and live tokens for all customers.

Chainalysis provides blockchain analysis tools to trace cryptocurrency transactions and investigate crimes such as fraud, ransomware, and money laundering. Its customer list includes law enforcement, government agencies, financial institutions, insurance companies, and cryptocurrency businesses worldwide.

This follows the company's disclosure last Friday that attackers using AI tools accessed customers' names, email addresses, user IDs, and organizational role labels using what it described as "offensive agentic techniques."

While it initially said the impact was limited and the breach affected only non-sensitive identity metadata, later updates revealed that usernames and password hashes for all customers were exposed in an "on-path attack" (more commonly known as a Man-in-the-Middle or MITM attack).

However, the company found no evidence that the attackers accessed investigative graph data or altered its blockchain attribution repositories.

"On Monday, we discovered certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor," it said in a Wednesday update. "At this time we continue to have no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated."

While the company locked Chainalysis accounts as a precaution after discovering that some customers' passwords had been exposed and asked users to reset their passwords before signing in again, it has now taken the login portal offline, together with Reactor and Data Solutions, the Know-Your-Transaction (KYT) user interface and API, and address screening products, after discovering further abnormal activity.

To ensure threat actors don't access affected accounts, Chainalysis asked customers to provide trusted IP addresses so they can regain access to the login portal once it is brought back online and reset their credentials.

"Contact [email protected] or your Chainalysis account team with trusted IP addresses for our allowlist. We will then grant access for users to reset their passwords and rotate API keys to register transactions. We are working around the clock to harden our systems and bring Reactor and Data Solutions back online. We will require additional protections to access accounts, including that every user will have to reset passwords and rotate API keys as appropriate," it added.

"Once access is granted, all users will be required to reset their passwords and rotate API keys, as applicable, before registering transactions," the company noted earlier today.

Chainalysis' disclosure follows several other security incidents affecting cryptocurrency companies in recent weeks. Ledger also asked Asian resellers and distributors last month to remove products from shelves and halt wallet sales while it is investigating multiple hardware implant incidents.

More recently, crypto exchange Binance revealed that North Korean hackers stole roughly $6.34 billion worth of cryptocurrency after compromising its wallet infrastructure by infecting an employee's laptop with malware during a fake job interview.