Chainalysis begins phased restoration of compliance tools after user credentials and tokens exposed
Blockchain analytics firm Chainalysis has begun a phased restoration of its KYT and Address Screening services after an attacker gained access to customer names, usernames, password hashes, and live authentication tokens for all users.
Blockchain intelligence firm Chainalysis has started bringing its Know Your Transaction (KYT) and Address Screening services back online through a phased rollout following a major security breach. According to company incident updates, an attacker accessed customer names, usernames, password hashes, and live authentication tokens across all Chainalysis users.[2][3][6][7]
The company initially discovered the exposure on Monday and took its Reactor and Data Solutions platforms offline while investigating. After detecting abnormal activity, Chainalysis also shut down the KYT interface and API, its address screening tools, and its login page. Chainalysis disclosed that some customer KYT accounts appeared to have been accessed without authorization and said it is directly notifying affected clients. Wu Blockchain reported that some users' plaintext passwords were leaked through a separate attack vector, expanding on a prior breach disclosure involving offensive AI agent tools.[1][3][5]
To safely restore services, Chainalysis is requiring all users to reset their passwords and rotate API keys before registering new transactions. The company is also asking customers to submit trusted IP addresses for allowlisting while working with external security specialists to harden its infrastructure. As journalist Laura Shin noted, Chainalysis has not disclosed how many KYT accounts were compromised or what the live tokens covered, and no timeline has been established for bringing Reactor and Data Solutions back online. Chainalysis maintains it has found no evidence that investigative data was accessed or attribution data was altered.[2][3][4]
Key facts
- Chainalysis confirmed customer names, usernames, password hashes, and live authentication tokens for all users were exposed to an attacker.
- Chainalysis disclosed that some customer KYT accounts appear to have been accessed without authorization.
- The company took its login page, KYT, Address Screening, Reactor, and Data Solutions platforms offline following the discovery of abnormal activity.
- Chainalysis has begun restoring KYT and Address Screening access via a phased rollout, requiring users to reset passwords and rotate API keys.
- Chainalysis stated it has found no evidence that investigative data was accessed or attribution data was manipulated.
- No return date has been announced for bringing Reactor and Data Solutions services back online.
Sources · 7 sources
- AB
American Banker@AmerBankerPost on X ·
.@chainalysis said Wednesday night that some customers' accounts appear to have been accessed without authorization and that password hashes and live tokens for all of its users got exposed to an attacker, five days after saying it had found no evidence of access to credentials or session tokens. More here: https://t.co/41sKsPxmJK
Open source - TB
The Block@TheBlockCoPost on X ·
THE BLOCK: Blockchain analytics firm Chainalysis said the attacker accessed names, usernames, password hashes, and live tokens for all its users. The firm took Reactor, Data Solutions, KYT, and its login page offline after detecting abnormal activity earlier this week. It said it still has no evidence that investigation data was accessed or attribution data manipulated.
Open source - CP
Crypto Patel@CryptoPatelPost on X ·
BREAKING: CHAINALYSIS BREACH JUST GOT MUCH WORSE! One of crypto's leading blockchain intelligence firms has confirmed exposure of password hashes and valid authentication tokens belonging to its users. 👉 Customer names, emails & user IDs exposed. 👉 Password hashes & live authentication tokens compromised. 👉 Actual passwords exposed for a subset of users. 👉 Reactor, Data Solutions & KYT services disrupted. Chainalysis says there's no evidence investigation data was accessed. The company is forcing password resets and API key rotations. A company trusted to investigate crypto crime is now dealing with a major security incident of its own. Stay SAFU.
Open source - LS
Laura Shin@laurashinPost on X ·
Chainalysis hasn't said how many customers' KYT accounts were accessed without authorization, or what the "live tokens" exposed for all its users cover. The analytics firm has also given no date for bringing Reactor and Data Solutions back. https://t.co/lqkQBnRxEl
Open source - WB
Wu Blockchain@WuBlockchainPost on X ·
Chainalysis: Names, Usernames, Password Hashes, and Valid Tokens of All Users Were Exposed; Some Plaintext Passwords Also Leaked Blockchain analytics firm Chainalysis disclosed in an updated security incident notice that the names, usernames, password hashes, and valid authentication tokens of all users had been exposed to the attacker, and that some customers’ plaintext passwords were also leaked through a separate attack method. After detecting abnormal activity, the company suspended KYT transaction monitoring, address screening, and login services, and required all users to reset their passwords and rotate API keys where necessary. Previously, on October 30, Chainalysis first disclosed that it had been breached by a hacker using offensive AI agent technology; at that time it only confirmed that certain customer identity information had been accessed and said it had found no evidence that passwords or session tokens had been leaked.
Open source - TM
That Martini Guy ₿@MartiniGuyYTPost on X ·
Chainalysis has started restoring services following its cyberattack, but the latest disclosure is pretty serious. The company confirmed that names, usernames, password hashes and live tokens were exposed to a malicious actor. It says there's currently no evidence that investigation data was accessed or its attribution data manipulated. Access to KYT and Address Screening is now being restored in phases. Affected users will have to reset passwords and rotate API keys. This is another reminder that crypto security risks extend far beyond wallets and smart contracts.
Open source - DE
Decrypt@DecryptMediaPost on X ·
Chainalysis Begins Restoring Services After All Users' Password Hashes and Tokens Were Exposed. Chainalysis began restoring KYT and Address Screening access Friday after disclosing that names, usernames, password hashes and live tokens for all users were exposed to a malicious actor.
Open source