.png){kind=logo}
Chainalysis has confirmed that a cyberattack exposed names, usernames, password hashes and live authentication tokens for users of its blockchain analytics platform. The company suspended several investigation and transaction monitoring products while it investigated unauthorized access to its systems.
In a November 6 update, Chainalysis said it had begun restoring access to its Know Your Transaction (KYT) and Address Screening services in stages. It has not announced a reopening date for Reactor and Data Solutions, which remain subject to security checks.
According to Chainalysis' official security update, the company disclosed the breach on October 30 after detecting an outside attacker using “offensive agentic techniques” to enter its systems and internal tools. Its initial investigation found that attackers had accessed customer profile information, including names, email addresses, user IDs and organizational roles.
At first, the firm said investigators had found no evidence that passwords or session tokens had been compromised. However, its November 4 update confirmed that names, usernames, password hashes and live tokens associated with all Chainalysis users had been exposed to a malicious actor.
The investigation also uncovered an “on-path attack” that captured a subset of customer passwords. This method allows an attacker to intercept information exchanged between a user and a service. Chainalysis said it had contained and fixed that attack method and locked affected accounts as a precaution.
The company said it was notifying customers whose KYT accounts appeared to have been accessed without authorization. It has not identified the attacker or disclosed how many accounts were improperly accessed.
Chainalysis took Reactor and Data Solutions offline on November 2 to conduct additional reviews. Both products support blockchain investigations and data analysis used by cryptocurrency firms and other organizations.
Initially, the company kept its transaction monitoring services running. However, after detecting abnormal activity on November 4, it also suspended the KYT interface and API, Address Screening products and its login page. KYT allows customers to screen cryptocurrency transactions for suspicious activity.
On November 6, Chainalysis said it had started restoring KYT and Address Screening through a phased process. The firm plans to expand access after checking that its strengthened security controls work as expected. It did not give a firm date for full restoration.
Reactor and Data Solutions remain offline while Chainalysis and outside cybersecurity specialists review the systems. The company said it continued work to bring those products back online safely.
Customers seeking restored access must submit trusted IP addresses to Chainalysis for approval. Once the company grants access, users must reset their passwords and rotate API keys where applicable before registering transactions.
Chainalysis also advised customers to change passwords on other services if they had reused their Chainalysis credentials. It warned users against following unexpected password-reset links and recommended two-factor authentication.
The company has not disclosed its password hashing method or described the types of live tokens exposed. It has also not established publicly whether the intercepted passwords and exposed tokens came from the same method of attack.
Despite the credential exposure, Chainalysis said it had “no evidence” that attackers accessed investigation data or changed its blockchain attribution records. That remains the company's assessment rather than a guarantee that no unauthorized access occurred.
The firm said the incident was unrelated to the recent Binance cryptocurrency theft. Its investigation remains underway, and further restoration updates are expected as security checks continue.
ALSO READ: US Regulators Check Bank Security Systems After Binance’s USD 6.3 Billion Hack