Chainalysis says cyberattack exposed password hashes and live tokens

The November 4 security update expands on the company’s October 30 disclosure, which had reported access to some customer profile details but no evidence that authentication credentials or session tokens were compromised. Chainalysis has since identified an “on-path attack” that intercepted a subset of customer passwords. It said the method has been contained and remediated, and that affected accounts are being locked as a precaution.

The company said it has no evidence that the incident exposed investigation data or altered its blockchain attribution data. It has not disclosed the password-hashing method or the type of live tokens involved. Third-party cybersecurity specialists are assisting with the investigation and efforts to strengthen its systems; Chainalysis also said large language models are supporting its internal security review.

Service suspensions began on November 2, when Reactor and Data Solutions were taken offline for security assessments. On November 4, suspicious activity involving the Know Your Transaction (KYT) service led the company to suspend its user interface and API, other address-screening products and its login page. Chainalysis said it planned to start restoring KYT and Address Screening access on November 5, initially allowing connections from approved customer IP addresses. It has not given a restoration date for Reactor or Data Solutions.

Customers were told to provide approved IP addresses to their account teams or support staff before regaining access to reset passwords and rotate API keys where needed. Chainalysis also advised users not to follow links in unsolicited reset emails, to change reused passwords elsewhere and to enable two-factor authentication if their organization had not done so. The company said its incident was unrelated to the October 29 Binance theft, estimated at $6.3 billion.