Chainalysis, the blockchain analytics company, has said that a cyberattack exposed credentials and live tokens for all of its customers. The company’s early statements had described the impact as limited, but later updates widened it, according to BleepingComputer, with Ars Technica reporting the same under a headline that hackers stole credentials and tokens for all of its customers.
What was exposed. According to summaries of the company’s updates, customer information including names, usernames, password hashes and live tokens for all Chainalysis users was exposed to a malicious actor. A password hash is a scrambled form of a password, and a live token is a credential that lets software or a person stay logged in. The company has not said which hashing method protected the passwords or what type of live tokens were involved.
How it happened. Chainalysis described the intrusion as the work of an external actor who used AI-agent-assisted offensive techniques to get into its systems and internal tools, according to the reports. Later updates said usernames and password hashes for all customers were exposed in what is called an on-path attack, also known as a man-in-the-middle attack. The company has not said where the infrastructure compromise occurred.
What the company did. Chainalysis took its login portal and several products offline after detecting further abnormal activity. Customers are asked to use a system that has them provide trusted IP addresses for an allowlist, after which they can reset passwords and rotate their API keys. Rotating a key means replacing it with a new one so that a stolen copy stops working.
What customers should do. Chainalysis advises customers to stay alert for suspicious communications and unexpected authentication requests, to switch on two-factor authentication, and to change any passwords they reused on other platforms. Those steps apply to anyone who ever used the same password elsewhere, even when a hash is hard to crack.
What is not known. The reports do not say who is behind the attack, how long the intruder had access, or whether any customer data beyond credentials was taken. One secondary source claimed that Chainalysis customers include government agencies and major banks, but that has not been verified and is left out here. These details come from the company’s updates as relayed by news outlets, and may change.
Why it matters. Chainalysis sells tools that investigators and compliance teams use to trace crypto transactions, so a breach of its customer credentials is sensitive for those teams. The mention of AI-agent-assisted techniques fits a wider trend, seen in recent attacks, of AI helping attackers move faster. For customers in the US and UK, the immediate task is to reset credentials and review access logs for the period before the company’s alert.
What to watch. Look for the date services return, a full incident report, details about the hashing and tokens, and any regulator or customer response.
Sources: BleepingComputer and Ars Technica (headline), with details from other outlets’ summaries of the company’s updates. Details are as reported and may change.
Programming code on a screen (representative image), Wikimedia Commons, CC BY-SA 4.0
