A week after calling the stolen data “non-sensitive”, Chainalysis now says usernames, password hashes and live tokens for every user of its platform were exposed, after an on-path attack on passwords. Its investigation and screening products were pulled offline, and customers must reset credentials and rotate API keys before screening resumes.
What happened
When we reported on the Chainalysis intrusion on 31 October, the blockchain analytics firm was describing a contained incident. An external actor using what it called “offensive agentic techniques” had reached internal systems and read user IDs, names, work email addresses and organisation role labels. The company said at the time that it had no evidence that authentication credentials or session tokens had been touched.
That position has now been reversed. Chainalysis has posted a series of dated updates to its incident page since then, and they tell a story of steady escalation:
- 2 November: Reactor, its investigation platform, and Data Solutions were taken offline as a precaution while security assessments ran. Compliance transaction monitoring stayed up.
- 4 November, morning (US Eastern): the company said an “on-path attack” had exposed some customers’ passwords, and it locked those accounts pending resets.
- 4 November, 40 minutes later: after spotting abnormal activity, it also took down KYT (its Know Your Transaction anti-money laundering product), address screening tools and the login page itself.
- 4 November, late evening: Chainalysis said it had established on the Monday that every user’s name, username, password hash and live token had been exposed. Customers whose KYT accounts appeared to have been used without authorisation were contacted directly.
- 6 November: KYT and Address Screening began a phased return, but only for customers who supply trusted IP addresses for an allowlist. No user can submit transactions again until they have changed their password and issued fresh API keys. There was still no return date for Reactor or Data Solutions.
The Register noted that the company now calls the intrusion an “ongoing multifront cyberattack”, and that password reset was itself unavailable for a time. Chainalysis maintains it has seen no evidence that investigations data was accessed or attribution data manipulated.
The technical picture
Chainalysis has not explained what “on-path” means in its environment, and that gap matters. In general usage the term describes an attacker positioned between a user and a service, able to read or alter traffic in transit. In a SaaS platform that could be a compromised proxy, a tampered authentication component or logging that captured credentials in transit. Each implies a different level of control, and the company has not said which applies.
The data types are the real concern. Password hashes can be cracked offline, and how quickly depends entirely on the algorithm and its parameters, which Chainalysis has not disclosed. Live tokens are worse. A valid session or API token typically lets an attacker act as that user with no password and no MFA prompt, until the token expires or is revoked. That is presumably why the company has moved to IP allowlisting and forced API key rotation rather than relying on password resets alone.
The decision to take KYT offline after “abnormal activity” also suggests that the attacker did more than read data. The company has confirmed some KYT accounts appear to have been accessed without authorisation, but not what was done with that access.
Why it matters for UK organisations
Chainalysis is not a niche supplier. Its customers include law enforcement, government agencies, exchanges, banks and security firms. UK cryptoasset businesses that have to monitor transactions for anti-money laundering purposes are exactly the sort of organisation that buys screening tools like KYT. For any UK customer, three things follow.
First, operational resilience. A firm that relies on a third party for transaction screening has just had that dependency go dark for days. If your AML controls assume the tool is always available, this is a live test of your fallback procedure.
Second, data protection. The exposure now covers credentials as well as names and work email addresses. Under UK GDPR, customer organisations need to establish whether Chainalysis acts as their processor for user account data and, if so, take their own view on whether the breach is notifiable to the ICO within 72 hours of becoming aware. The scope change on 4 November arguably restarts that assessment.
Third, targeting. The original concern was that a list of named investigators and compliance staff would feed tailored phishing. Add live tokens and crackable hashes and that list becomes far more useful.
Expert view
What stands out to me is not the breach itself but the pattern of disclosure. On 30 October there was no evidence credentials or session tokens had been accessed. Five days later, the company said all were exposed. Early statements are written with incomplete information, and the candid updates since deserve credit. But initial “no evidence of” language means exactly that and nothing more. In my experience, the first assessment of scope is rarely the last, particularly when the attacker is still active, which Chainalysis’s own “multifront” description implies.
The token exposure is the part I would worry about most. When we test SaaS platforms, long-lived API tokens are a recurring weakness: issued once, embedded in scripts and integrations, and never rotated. Forced rotation will break automations, and the temptation is to reissue keys with the same broad permissions. Scope them down instead.
Whether a person or an AI-driven framework was at the keyboard, the attacker apparently reached a position to intercept authentication traffic and harvest tokens. That is a failure of identity and network design, not something unique to AI.
What to do now
- Rotate everything. Reset passwords for all Chainalysis users in your organisation and rotate every API key, including those embedded in scripts, SIEM integrations and screening pipelines. (Cyber Essentials: secure configuration, user access control.)
- Check for reuse. Chainalysis has advised users to change passwords anywhere they reused them. Enforce that, and confirm your password manager and SSO policies make reuse unnecessary.
- Review activity. Ask Chainalysis for logs covering your users and API keys during the exposure window, and look for screening queries, exports or configuration changes nobody recognises.
- Prepare for phishing. Warn named users that emails or calls referencing their Chainalysis role, cases or account are likely, and route any “password reset” or “re-verification” message through a known channel.
- Test your AML fallback. Document how transaction screening continues if the vendor is offline, who signs off on manual checks, and how decisions are recorded.
- Make a UK GDPR decision. Record your controller or processor analysis, your view on ICO notification and your reasons, dated from when you learned of the widened scope.
- Update third-party risk records. Note the incident, the shift in disclosed scope and the outstanding questions: the hashing algorithm, the nature of the on-path position and the KYT activity.
Bottom line
The Chainalysis breach has moved from an exposed contact list to a full credential and token compromise affecting every user, with core products offline and an attacker the company still describes as active. UK customers should treat their accounts and API keys as compromised, rotate them now, and press the vendor for the details it has not yet published.
Sources
- Chainalysis: Updated Nov 6: Chainalysis Security Incident Information
- BleepingComputer: Chainalysis says breach exposed credentials for all customers
- The Register: October crypto-tracker hack: Access cracked, law enforcement tokens packed
- SecurityWeek: Chainalysis Discloses Data Breach Following AI-Driven Cyberattack
