Chainalysis now says the attack on its systems exposed password hashes and live tokens for every one of its users, reversing the assurance it gave when it first disclosed the breach on October 30. The blockchain-intelligence firm, whose tools police forces, banks and crypto companies use to trace criminal transactions, said on November 4 that it had discovered the wider exposure two days earlier. Three of the products it took offline are back in service as of November 7, while the company orders every customer to reset passwords and rotate API keys.
What changed on November 4
The first disclosure, published October 30, described a limited incident. Chainalysis said an external actor had used what it called ‘offensive agentic techniques’ to reach its systems and internal tools, and that only non-sensitive customer data had been accessed: user IDs, full names, email addresses and organisation role labels.
It also said it had found no evidence that authentication credentials or session tokens had been touched, and it stressed that the incident was unrelated to the recent theft at Binance. That assurance lasted five days. On November 4, the company’s incident page carried three updates in a single day, each one worse than the last.
The morning brought the first crack. At 9:50 a.m. Eastern, Chainalysis told some customers that an ‘on-path attack’ — an attacker sitting between users and the company’s systems — had exposed a subset of customer passwords. The company said that attack vector had been contained and remediated, locked the affected accounts, and told customers to reset their passwords.
By 10:30 a.m., the picture had darkened further. Chainalysis said it had found abnormal activity on its transaction-screening products and took its Know Your Transaction interface and API offline, along with other address-screening products and the login page. Reactor, Data Solutions and Chain (Beta) were already offline, and password resets stopped working while the login page was down.
The full scale arrived that night. In an 11 p.m. update, Chainalysis said that on Monday, November 2, it had discovered that names, usernames, password hashes and live tokens for all Chainalysis users had been exposed to a malicious actor. The company said it was directly notifying customers whose Know Your Transaction accounts appeared to have been accessed without authorisation.
The slow road back online
Restoration began in phases on November 6, with customers asked to send trusted IP addresses for an allowlist before they could reconnect. On Saturday, November 7, Chainalysis said Reactor, Know Your Transaction and Address Screening were back online with enhanced security measures.
Data Solutions had not yet returned when that update was published. Every user must still reset passwords and rotate API keys before registering transactions, and the company has not published a count of affected users or said which hashing algorithm protects the passwords.
Our read
The reversal is the story. A company that investigates cybercrime for a living told its customers on October 30 that no credentials had been touched, then spent a week taking its own products offline one by one as the evidence grew.
The two-day gap between discovering the wider exposure on November 2 and disclosing it on November 4 will draw questions, and Chainalysis has not explained it. What the company calls ‘offensive agentic techniques’ also remains undefined: it has published no technical detail of how the attacker got in, or what role AI tools actually played.
The live tokens are the sharpest part of the disclosure. A password hash can be attacked offline, but a live token is a working key: whoever holds one is treated as the user, with no password needed and no login challenge to pass.
That is why the reset-and-rotate order matters more than the hash debate, and why police forces, banks and exchanges had to treat every Chainalysis account as exposed at once. It fits a pattern of agents becoming the attack surface, from an agent that escaped its sandbox at WorkOS to agents steering intrusions at more than 200 organisations.
Why It Matters
Chainalysis is not a consumer app. Its tools trace the money behind ransomware, fraud and sanctions evasion, and its customers include law enforcement agencies, government bodies, financial institutions and crypto businesses around the world. A breach that hands attackers the credentials of the people doing that tracing is a security problem for the whole ecosystem, not just one company.
The incident also lands in a week when the industry is still absorbing OpenAI’s claim that its agents validated 948 Linux privilege-escalation flaws and research showing nine agents failing basic integrity checks. Agents are now powerful enough to be useful to attackers and to defenders alike, and the firms that police them are learning that the hard way.
Background
Chainalysis first disclosed the incident on October 30, when it said an external actor had used ‘offensive agentic techniques’ to reach its systems; our first report covered that disclosure and the limited data then known to be accessed. The company says it still has no evidence that investigation data was accessed or that its attribution records were manipulated.
Source: Chainalysis’s incident updates and BleepingComputer’s report
0 Comments