Chainalysis provides tools for tracing cryptocurrency transactions and investigating fraud, ransomware and money laundering, and its customers include law enforcement, government agencies, financial institutions and crypto businesses. The company first said attackers using AI tools, "offensive agentic techniques", obtained only names, email addresses, user IDs and organizational role labels.
Later updates admitted that usernames and password hashes for all customers were exposed in an on-path (man-in-the-middle) attack. "On Monday, we discovered certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor," it said in a Wednesday update. According to BleepingComputer, the company found no evidence that investigations data was accessed or its attribution data manipulated.
After spotting further abnormal activity, Chainalysis took offline its login portal, Reactor and Data Solutions, the KYT interface and API, and its address screening products. Customers are asked to submit trusted IP addresses for an allowlist, after which every user must reset passwords and rotate API keys before registering transactions again. Who the attacker is and when the products will return has not been disclosed.