Blockchain intelligence firm Chainalysis has taken its customer login portal and core investigative products offline after disclosing a cyberattack exposed credentials and live tokens for every one of its customers. The company, which provides blockchain analysis to law enforcement and financial institutions worldwide, said it detected further abnormal activity after its initial breach disclosure last week.
In an incident notice update on Wednesday, Chainalysis disclosed that usernames, password hashes, and live tokens for all Chainalysis users had been exposed by what it described as an 'on-path attack', effectively a Man-in-the-Middle attack. "On Monday, we discovered certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor," the company stated.
The company is a blockchain intelligence firm, providing tools to trace cryptocurrency transactions and investigate fraud, ransomware, and money-laundering crimes. Its customer list includes law enforcement, government agencies, financial institutions, insurance companies, and cryptocurrency businesses worldwide.
Chainalysis first reported a security incident on Oct. 30, saying the intrusion had exposed user IDs, names, and email addresses but that there was no evidence authentication credentials had been compromised. That assessment has now been overturned. Monday's investigation revealed that attackers using what Chainalysis called 'offensive agentic techniques' and AI tools had in fact stolen credential data, forcing the company to update its guidance and begin locking accounts.
Chainalysis has taken its login portal offline, along with Reactor and Data Solutions, its Know-Your-Transaction (KYT) interface and API, and its address screening products, after discovering further abnormal activity. To prevent threat actors from accessing affected accounts, the company has asked customers to submit trusted IP addresses for an allowlist. Once access is granted, all users will be required to reset their passwords and rotate API keys as applicable.
Despite the broader exposure, Chainalysis said it continues to have no evidence that attackers accessed investigation data or manipulated its blockchain attribution repositories. “We are working around the clock to harden our systems and bring Reactor and Data Solutions back online,” the company added. The incident follows several other security incidents affecting cryptocurrency companies in recent weeks, including Binance’s disclosure that North Korean hackers stole roughly US$6.34 billion worth of cryptocurrency.
Analysis
Why This Matters
- Chainalysis is a critical piece of infrastructure for combatting crypto crime; a breach of this scale exposes the operational security of its law enforcement and government clients worldwide.
- The takedown of Reactor and Data Solutions means investigations into illicit crypto flows are currently severely degraded or halted, potentially allowing criminal activity to go undetected.
- The use of an 'on-path attack' and advanced AI techniques by the threat actor signals a sophisticated, likely state-sponsored or highly organised group targeting crypto intelligence infrastructure.
Background
The company is a leading provider of blockchain analytics tools for tracing illicit cryptocurrency transactions. Its clients include law enforcement, government agencies, financial institutions, and crypto businesses. The Oct. 30 disclosure described a limited breach of identity metadata. Further investigation over the weekend revealed a much deeper intrusion, forcing the company to take its core products offline and implement an allowlist-based recovery system. The incident is part of a wider trend of major security breaches in the crypto sector, including attacks on hardware wallet maker Ledger and a US$6.34 billion theft from Binance.
What to Watch
- When Chainalysis brings Reactor and Data Solutions back online, and whether the downtime has allowed criminal transactions to move through the blockchain without detection.
- Whether the attackers leverage stolen credentials or live tokens to track government investigations or impersonate Chainalysis customers.
- How the incident affects the trust relationship between crypto intelligence firms and their government clients, and whether it triggers new compliance or security requirements for the sector.
Checked
11 claims in this story checked against 2 sources: 9 supported.
Show each claim
- Reports differThe breach exposed credentials and live tokens for every Chainalysis customer.Cointelegraph.com News: “The company did not disclose whether each type of information was exposed for every user”
- SupportedChainalysis took its login portal and core investigative products offline.BleepingComputer: “it has now taken the login portal offline, together with Reactor and Data Solutions, the Know-Your-Transaction (KYT) user interface and API, and address screening products”
- Partly supportedThe company’s Monday investigation found that attackers using “offensive agentic techniques” and AI tools had stolen credential data.BleepingComputer: “attackers using AI tools accessed customers' names, email addresses, user IDs, and organizational role labels”
- SupportedChainalysis said: “On Monday, we discovered certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor.”BleepingComputer: “"On Monday, we discovered certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor," it said in a Wednesday update.”
- SupportedChainalysis said: “We are working around the clock to harden our systems and bring Reactor and Data Solutions back online.”BleepingComputer: “We are working around the clock to harden our systems and bring Reactor and Data Solutions back online.”
- SupportedChainalysis reported that an on-path attack exposed some customers’ passwords.Cointelegraph.com News: “Another Wednesday update stated an “on-path attack” exposed some customers’ passwords.”
- SupportedChainalysis first reported the incident on Oct. 30, saying user IDs, names and email addresses were exposed but there was no evidence authentication credentials had been accessed.Cointelegraph.com News: “Chainalysis initially said on Oct. 30 that the intrusion exposed user IDs, names and email addresses but found no evidence that attackers accessed authentication credentials or session tokens.”
- SupportedChainalysis reported further abnormal activity and took the login portal and listed products offline after discovering it.BleepingComputer: “it has now taken the login portal offline, together with Reactor and Data Solutions, the Know-Your-Transaction (KYT) user interface and API, and address screening products, after discovering further abnormal activity.”
- SupportedChainalysis asked customers to provide trusted IP addresses for an allowlist before access is restored.BleepingComputer: “Chainalysis asked customers to provide trusted IP addresses so they can regain access to the login portal once it is brought back online”
- SupportedChainalysis said it had no evidence attackers accessed investigation data or manipulated its attribution data.Cointelegraph.com News: “Despite the broader exposure, Chainalysis said it still had no evidence that attackers accessed investigation data or manipulated its attribution data.”
- SupportedThe story says North Korean hackers stole roughly US$6.34 billion worth of cryptocurrency from Binance.BleepingComputer: “Binance revealed that North Korean hackers stole roughly $6.34 billion worth of cryptocurrency”
