TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Chainalysis said on Nov. 4 that names, usernames, password hashes and live tokens for all its users had been exposed to a malicious actor. That update widened the company’s Oct. 30 disclosure, which said it had found no evidence of access to credentials or session tokens. The hash algorithm, meaning of “live tokens” and number of affected accounts remain undisclosed.
Chainalysis said Nov. 4 that a malicious actor had accessed names, usernames, password hashes and live tokens belonging to all Chainalysis users, broadening a breach disclosure issued five days earlier. The blockchain analytics company had initially said it found no evidence of access to authentication credentials or session tokens; the changed account raises questions for customers about account security and the scope of the incident.
In its Oct. 30 incident post, Chainalysis said an external actor had gained unauthorized access to company systems and internal tools during October. The information then identified as accessed included user IDs, full names, email addresses and organization role labels for users on the platform. The company described that information as “non-sensitive customer data” and said there was “no evidence of unauthorized access to investigation content, authentication credentials, or session tokens.”
On Nov. 4 at 11 p.m. Eastern, the company added that it had discovered on Monday, Nov. 2, that “names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor.” It said some KYT accounts appeared to have been accessed without authorization and that it was notifying the customers concerned. The company has not published a count of those accounts.
Chainalysis took Reactor and Data Solutions offline on Nov. 2 as it responded to ongoing cyber threats. On Nov. 4, after reporting abnormal activity, it also took its KYT transaction-monitoring interface and API, other address-screening products and its login page offline. KYT and Address Screening began returning in phases on Nov. 6. Chainalysis said users would need to provide trusted IP addresses for an allowlist, reset passwords and rotate API keys, where applicable, before registering transactions. Reactor and Data Solutions were still being restored in the latest update described in the source material.
Chainalysis breach updates password hashes and live tokens exposed
On Nov. 4, Chainalysis said information for all users had been exposed, widening its earlier account of the breach. Key technical details and the number of accounts accessed remain unclear.
What the updates disclosed
The company’s account changed from no evidence of credential access to reported exposure of password hashes and live tokens.
- User IDs, names, email addresses and role labels
- No evidence of credential or session-token access
- Names, usernames, password hashes and live tokens
- Some KYT accounts appeared accessed without authorization
What remains unknown
The public updates leave important questions open for customers.
Hash protection
The hashing method and its settings have not been disclosed.
“Live tokens”
Their type, validity and possible use have not been explained.
Affected count
The number of accounts accessed without authorization is unpublished.
Access assessment
The later update does not clarify whether investigation content was accessed.
Service status and customer actions
Services returned in phases, with account steps required before transactions could be registered.
Customers were asked to provide addresses for allowlisting.
Change reused passwords on other services as well.
Rotate applicable keys before registering transactions.
KYT and Address Screening were returning in phases; Reactor and Data Solutions were still being restored.
The Changed Scope Raises Account Risks
The revised disclosure matters because password hashes and live tokens can affect account security, while the earlier statement gave customers a narrower understanding of what had been accessed. A hash is a stored representation of a password, but its practical risk depends on details Chainalysis has not provided, including the hashing method and its settings. The term “live tokens” also has no public explanation in the updates summarized here.
Service outages affected access to investigation and screening products used by customers in the cryptocurrency and financial sectors. Chainalysis says it serves government agencies, exchanges, financial institutions and cybersecurity companies in more than 70 countries, and reports having over 1,500 customers. Those figures are company statements. The incident does not establish that customer investigation data was accessed; the initial post said the company had found no evidence of that, and the later disclosure cited here does not clarify whether that assessment changed.
Customers should treat the updated exposure as a reason to secure accounts and watch for messages that use names or organizational roles. Chainalysis’s stated recovery requirements include password resets and API-key rotation. Users should use the login address they already trust when changing credentials and avoid reusing exposed passwords elsewhere.
Products Worth Considering
LG UltraGear 32GS60QC-B 32-inch Curved QHD Gaming Monitor (180Hz, 1ms, 1000R, AMD FreeSync, HDR10)
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
Bose QuietComfort 45 SE Wireless Noise-Cancelling Over-Ear Headphones
As an affiliate, we earn on qualifying purchases.
Five Days of Disclosure Changes
Chainalysis maintains a dated incident post that was first published Oct. 30 and later updated. The sequence described in the source material shows several changes within five days. The initial post said there was no evidence that credentials or session tokens had been accessed. On Nov. 2, the company took Reactor and Data Solutions offline as a precaution.
On the morning of Nov. 4, an email to certain customers described an “on-path attack” that had exposed a subset of customer passwords. Chainalysis said that attack path had been contained and remediated, locked the affected accounts and asked those users to reset passwords. About 40 minutes later, abnormal activity prompted the company to take additional products and the login page offline. That evening, its public incident post reported exposure of password hashes and live tokens for all users.
The company said the breach was not related to a recent crypto theft at Binance. The material provided does not offer independent technical findings about the intrusion. Chainalysis attributed the access to an external actor using what it called “offensive agentic techniques,” without defining the phrase.
Technical Details Still Missing
Chainalysis has not disclosed the password-hashing algorithm or its configuration, what it means by “live tokens,” or how many users’ accounts were accessed without authorization. The updates also do not identify the actor or explain the phrase “offensive agentic techniques.”
It remains unclear whether the company’s later findings changed its assessment of access to investigation content. The Oct. 30 post said there was no evidence of such access; the Nov. 4 disclosure cited here names user information, password hashes and tokens but does not state whether investigation content was accessed. The source material also does not give a final restoration date for Reactor and Data Solutions.
Service Restoration and Account Resets
Chainalysis’s Nov. 6 update said KYT and Address Screening were returning in phases. Customers were asked to submit trusted IP addresses for allowlisting, then reset passwords and rotate API keys where applicable before registering transactions. The company had not yet said when Reactor and Data Solutions would be fully available.
Customers should follow account instructions through established Chainalysis channels, change any password reused on other services, rotate relevant API keys and be alert to phishing messages that use their names or roles. Further incident updates would be needed to clarify the token exposure, the affected account count, the intrusion method and whether any investigation content was accessed.
Key Questions
What information did Chainalysis say was exposed?
In its Nov. 4 update, Chainalysis said names, usernames, password hashes and live tokens for all users were exposed to a malicious actor. Its earlier Oct. 30 post had listed user IDs, names, email addresses and organization role labels.
Did Chainalysis say every account was accessed?
No. The company said information for all users was exposed, but said only that some KYT accounts appeared to have been accessed without authorization. It has not published a count of those accounts.
What does the company mean by “live tokens”?
The updates summarized in the source material do not define “live tokens.” Their type, validity and possible use remain unclear from the public information provided.
What should Chainalysis customers do?
Chainalysis said users would need to reset passwords and rotate API keys where applicable before registering transactions as services returned. Users should change reused passwords and access the login page through an address they already trust.
Are all Chainalysis products back online?
Not according to the Nov. 6 update described here. KYT and Address Screening were returning in phases; Reactor and Data Solutions were still being restored.
Source: Thorsten Meyer AI
