Chainalysis Confirms Password Hashes and Live Tokens Were Taken in October Breach

Chainalysis, a blockchain analysis company with high-profile global customers and partners, has confirmed that attackers who broke into its systems in October took usernames, password hashes and live tokens. The company detected the intrusion on October 30. Earlier updates had confirmed that user IDs, full names, email addresses and organisational role labels were exposed, so the latest disclosure shows the impact is larger than first reported.

Chainalysis has not said which hashing algorithm protects its users' passwords, so it is hard to judge how easily the hashed credentials could be cracked offline. Some users received emails telling them to change their passwords, but the company says its password reset function is currently down. It has urged users to change passwords on any other site where they reuse credentials. The company also detected abnormal activity on its transaction screening products and took several services offline, including the Reactor investigation platform used by law enforcement, the Data Solutions threat intelligence platform, and the KYT login page and interface. It says it has no evidence that investigations data was accessed or that its attribution data was manipulated.

Chainalysis plans to restore KYT and its Address Screening tool on Thursday, November 5. Customers will need to give their support team or account manager trusted IP addresses for an allowlist before they can begin resetting passwords.