Chainalysis says breach exposed hashes and live tokens for all users

Chainalysis disclosed that names, usernames, password hashes and live tokens for all its users were exposed to a malicious actor, putting account security and customer operations at risk. In its security incident update, the blockchain analytics firm said it discovered the exposure on Monday, November 2, and disclosed it late Wednesday, November 4. It has not said how many users were affected or whether every data type was exposed for each person.

The update followed an October 30 notice that said the company had found no evidence credentials or session tokens were accessed. Chainalysis described an external actor gaining unauthorized access to its systems and internal tools, but has not identified the attacker or explained what it meant by “offensive agentic techniques.”

What do the exposed hashes and live tokens allow?

A password hash is a transformed representation of a password, rather than the password in clear text. A live token is an active digital credential that can help authenticate a user. In a plain analogy, the hash is like a scrambled imprint of a key, while a live token can function more like a temporary entry pass. Chainalysis has not disclosed how it generated the hashes or what kind of tokens were exposed. The Record from Recorded Future News reported those details remain unclear, and noted that some hashes may be crackable while active tokens may allow account access without a password.

The company separately told some customers their passwords had been exposed in an “on-path attack,” where an attacker intercepts communication between a user and a service. Chainalysis said it contained and remediated that attack. It has not established publicly whether that interception, the exposure of hashes and tokens, and suspected unauthorized account access used the same method or involved the same attacker.

Which Chainalysis services were affected?

Chainalysis took products offline as it responded to the incident and to abnormal activity. The affected services included Reactor, used for investigations; KYT, which monitors transactions for suspicious activity; and Address Screening. The company also took its login page offline. It said some customers’ KYT accounts appeared to have been accessed without authorization, and that it was notifying those customers directly.

The response interrupted tools used by organizations that investigate blockchain activity and monitor crypto transactions. Chainalysis said it had no evidence that investigation content, such as graphs, notes or cases, had been accessed, or that its attribution data had been manipulated.

What must users do as services return?

In its November 7 update, Chainalysis said Reactor, KYT and Address Screening were back online with enhanced security measures. It instructed customers to reconnect using steps sent by email. The company said all users would need to reset passwords and rotate API keys where applicable; customers had also been asked to provide trusted IP addresses for an allowlist during phased restoration.

That makes credential renewal part of regaining access, not just a precaution for users whose passwords Chainalysis says were intercepted. The firm has not published a user count, the hashing method, or further details about the exposed tokens. Its public account also leaves unresolved whether every affected account had all four listed data types exposed.

Sources and documents

• security incident update — chainalysis.com
• reported those details remain unclear — therecord.media