Chainalysis Says Breach Exposed Credentials For All Customers

Chainalysis revealed that attackers obtained usernames, hashed passwords, and live tokens for every customer. Responding to the initial compromise, the company prompted users to alter their passwords and then suspended the login portal along with Reactor, Data Solutions, the KYT user interface and API, and address screening features following the discovery of additional suspicious behavior.

Although the firm maintains no proof that investigative data or blockchain attribution records were accessed or modified, all users will be compelled to reset passwords and swap API keys before reaccessing. Chainalysis offers blockchain analysis tools to assess cryptocurrency transactions and probe crimes like fraud, ransomware, and money laundering, serving a global clientele comprising law enforcement, government entities, financial institutions, insurers, and crypto businesses.

Last Friday, the company disclosed that malicious actors exploited AI tools to obtain customers' names, emails, user IDs, and organizational role tags via what Chainalysis termed "offensive agentic techniques." Although the breach was initially deemed limited, affecting only non-sensitive identity metadata, subsequent updates disclosed that usernames and password hashes for all customers were exposed in an "on-path attack," also referred to as a Man-in-the-Middle attack.

Nevertheless, Chainalysis has not found any evidence that the attackers tampered with investigative graph data or tampered with its blockchain attribution repositories. To preclude threat actors from accessing compromised accounts, Chainalysis solicited customers to supply trusted IP addresses to regain entry to the login portal and reset credentials once the service is reactivated.