NewsCompaniesFlawsGuides
Get the app

Chainalysis says login details for all its users were exposed; customers should reset passwords and rotate API keys

From the HARD Situation Room · First reported
For everything else happening in security now, see the Situation Room.
chainalysis.com: Updated Nov 6: Chainalysis Security Incident Information - Chainalysis
Screenshot: chainalysis.com

Chainalysis first said only basic details were accessed. On 4 November it said names, usernames, password hashes and live tokens for all users were exposed, some passwords were intercepted, and some KYT accounts were used without permission. Reactor and Data Solutions are offline; KYT is returning in phases.

Chainalysis now says names, usernames, password hashes and live tokens for all its users were exposed. Organisations that use it should reset passwords and rotate API keys.

Current event. First reported . Details may change as more becomes known; updates will be added to the timeline.

What happened

If your organisation uses Chainalysis, treat every user’s Chainalysis password, and any API keys, as exposed. The blockchain-analysis company now says names, usernames, password hashes and live tokens for all of its users reached an attacker.

Chainalysis first disclosed the incident[1] on 30 October and said then that only basic details, such as names, email addresses and role labels, had been accessed. On 4 November it widened that twice: some customers’ passwords had been intercepted between them and the service, and login details for all users had been exposed, which it says it found on 2 November. It also found signs that some KYT accounts were used without permission, and says it is telling those customers directly.

Chainalysis breachReactor, KYT and Address Screening
HARD level
High for organisations that use Chainalysis
Who
All Chainalysis users, the company says
Exposed
Names, usernames, password hashes and live tokens; some passwords intercepted
Not found
No evidence investigations data was accessed or attribution data changed, the company says
Services
KYT and Address Screening returning in phases from 6 November; Reactor and Data Solutions offline, no date
What’s known.Chainalysis’s own updates, 30 October to 6 November.

Timeline

  1. HARD publishes its article, at High.

Who is affected

Chainalysis sells to law enforcement, government agencies, banks and crypto businesses, according to BleepingComputer[2]. Families don’t usually hold accounts, but a family office, fund or exchange that screens crypto transactions may use it directly or through a compliance provider. Ask whoever runs that.

The company hasn’t said how many people are affected, or whether every kind of data applies to every user. It has not named the attacker, said how the passwords were hashed, or explained what a live token is, The Record reports[3]. Chainalysis blames “an external actor using offensive agentic techniques” but hasn’t said what that means. On 30 October it said the incident was unrelated to the Binance theft.

A password hash is not a password, but it can be cracked. Reset it anyway.

What Chainalysis has shut down

Reactor, its investigations tool, and Data Solutions went offline on 2 November. On 4 November, after what it calls abnormal activity, it also took down KYT (the transaction-monitoring screen and its API), its other address-screening products and its login page. Its 6 November update[1] says KYT and Address Screening are coming back in phases. There is no date yet for Reactor or Data Solutions.

What to do this week

  1. Reset every user’s password from the real login page.Type the Chainalysis address yourself. The company says not to use links in password-reset emails.
  2. Rotate API keys before sending transactions again.Chainalysis asks customers to rotate keys, where they use them, before registering transactions with KYT once access is back.
  3. Send your trusted IP addresses to get back in.Access is being restored to known networks first. Send yours to [email protected] or your account team, as the company’s update asks.
  4. Change the same password anywhere else it was used.If anyone reused their Chainalysis password, change it on those accounts too, starting with email and banking. Turn on two-step sign-in wherever it’s offered.
  5. Check what happened while screening was down.Ask your compliance team which transactions went through without KYT checks, and whether anything in your account looks unfamiliar. Report it to Chainalysis.

References

  1. ^ Chainalysis (). “Security incident: updates and next steps”. The company’s own updates, 30 October to 6 November: what was exposed, which services are offline, and the steps customers are told to take.
  2. ^ BleepingComputer (). “Chainalysis says breach exposed credentials for all customers”. How the disclosed scope widened, and the allowlist step for regaining access.
  3. ^ The Record (). “Chainalysis warns all users hit in cyber breach involving ‘agentic’ techniques”. The customer base, what the company hasn’t explained, and when services were due back.
  4. The Register (). “October crypto-tracker hack: Access cracked, law enforcement tokens packed”. Secondary reporting, read against the company’s updates.

Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.