Chainalysis Locks Accounts and Takes Services Offline After Breach Exposes All Users' Credentials

Blockchain analysis firm Chainalysis has confirmed that its investigation into an attack on its systems found that names, usernames, password hashes and live tokens for all users were exposed. The company says it has no evidence that any investigations data was accessed or that its attribution data was manipulated. While it investigated, it removed access to Reactor and Data Solutions, and took the Know Your Transaction (KYT) user interface and API, other address screening products and the login page offline.

The disclosure comes less than a week after Chainalysis said an external actor used offensive agentic techniques to gain unauthorised access to its systems and internal tools. The company earlier described an "ongoing multi-front cyber attack" and an "on-path attack" that exposed a subset of customer passwords. It says that attack vector has since been addressed. It has also added proactive monitoring to detect unusual activity and locked the impacted accounts as a precaution. It is unclear who is behind the attack, though Chainalysis says it resembled incidents at many other tech platforms in recent weeks.

Customers who received an email asking them to reset their password cannot do so for now. Chainalysis still encourages people to change passwords on other systems where they may have reused credentials. It plans to restore KYT and Address Screening, and asks customers to send trusted IP addresses to its support team or account team for an allowlist. Every user will then need to reset their password and rotate API keys as appropriate.