Chainalysis cyberattack exposes usernames, password hashes, and authentication tokens
When blockchain detectives become targets.
Photo by Annette Riedl/picture alliance via Getty Images.
Follow us
- Chainalysis says names, usernames, password hashes, and live tokens for users were exposed.
- The company says it has no evidence that investigation data was accessed or attribution data was changed.
- Chainalysis reset all customer passwords and urged users to change reused passwords elsewhere.
- Some products went offline while money laundering monitoring tools stayed online under close watch.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Names, usernames, password hashes, and live authentication tokens for all Chainalysis users have been exposed to a malicious actor.
On Friday, October 30th, Chainalysis, a US-based cryptocurrency company that investigates illicit transactions, discovered it had been targeted.
An external actor was caught using “offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools,” the company said.
At that time, there was no evidence of unauthorized access to investigation content (graphs, notes, or cases), authentication credentials, or session tokens.
However, data deemed “non-sensitive,” such as user IDs, full names, email addresses, and organization role labels for users provisioned on Chainalysis’ platform, were accessed.
As a precaution, some products were taken offline, including Reactor, Data Solutions, and Chain (Beta). Tools for monitoring money laundering were kept online and closely monitored for unusual activity.
On Wednesday, November 4th, Chainalysis discovered that certain customer information, including names, usernames, password hashes, and live tokens for all Chainalysis users, was exposed to an unknown threat actor.
“At this time, we continue to have no evidence that any investigation data has been accessed or Chainalysis attribution data has been manipulated,” according to Chainalysis.
The cyberattack was part of a so-called ‘on-path attack,’ formerly called a man-in-the-middle (MitM) attack, typically used to steal sensitive information, intercept authentication tokens, modify data, redirect users to malicious websites, and secretly monitor online communications.
As a result of the cyberattack, all customers' passwords have been reset. Customers are encouraged to reset their passwords on other systems and online accounts where their login credentials have been reused.
Customers whose KYT (Know Your Transaction) accounts may have been accessed without authorization will be notified. KYT is a service that allows companies to monitor cryptocurrency transactions.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
