Chainalysis Says Password Hashes and Live Tokens Exposed for All Users

Chainalysis told customers on Wednesday night that the break-in it disclosed the previous Friday had gone further than it first said. Names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor, the blockchain analytics firm wrote in an update to its security notice, dating the discovery to Monday. It pulled Reactor and Data Solutions, the products clients run investigations in, offline while it looked. The KYT interface and its application programming interface went with them, along with address screening and the login page. For a stretch, customers told by email to reset their passwords could not reach the page that does it.

Friday's notice, and Wednesday's

The 30 October notice described an outside actor using "offensive agentic techniques" and listed identity data: user IDs, names, email addresses and, in some accounts, the role labels attached to accounts. It also said there was no evidence that authentication credentials or session tokens had been reached. That second sentence is the one this week's update retracts in substance. The split over whether that first notice listed four fields or five is no closer to settled. Cointelegraph names three fields, BleepingComputer and eSecurity Planet add the role labels, and The Hacker News gives no list at all.

One attack, or two

Here the accounts part. Cointelegraph, The Hacker News, eSecurity Planet and Bitcoin.com each describe two findings: an on-path attack, meaning an interception sitting between a user and the service, which exposed passwords for a subset of customers, and then the wider exposure disclosed later. BleepingComputer folds them together, writing that usernames and password hashes for all customers were exposed in the on-path attack. Four accounts keep the two events apart and one merges them. They do not reconcile. The sentence all five trace back to is the company's own.

"On Monday, we discovered certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor," the update said.

Chainalysis's notice was not read at this desk. Cointelegraph and BleepingComputer quote that line identically, both linking to the same blog post.

The shutdown one outlet does not mention

Cointelegraph's Friday piece reports no service outage at all, and it is the account most crypto readers will meet first. The other four list the same products down: Reactor, Data Solutions, KYT and its API, address screening and the login portal. BleepingComputer ties the last of those to "further abnormal activity" found after accounts had been locked. Chainalysis said on Wednesday it meant to start restoring KYT and address screening the next day through an allowlist of trusted customer addresses. A Friday update put the order plainly: access first, then password resets and API key rotation before anyone registers transactions again.

Nobody has published a number

The gaps are large and specific. No account read here gives a count of affected customers or organizations, how long the attacker held access, who the attacker is, or any ransom demand. None establishes what the live tokens authorize, how the passwords were hashed, or whether existing sessions were invalidated. "It's unclear who is behind the attack," The Hacker News wrote. One denial does keep repeating, in the same words each time: no evidence that investigations data has been accessed or that Chainalysis attribution data has been manipulated. That denial is the one that counts, because the attribution data is the product. The firm's analysts traced $387.5 million across four chains in minutes after an exchange theft in September, and its customer list runs through exchanges, banks, insurers, regulators and law enforcement. Chainalysis says this incident is unrelated to the theft at Binance, where its own loss estimate and the exchange's never matched. Whether the exposed tokens were used anywhere is the question nobody has answered. The resets now being forced on every account are the only sign of how the company is treating them.