Chainalysis Used Large Language Models in Response to Credential Exposure

Chainalysis said it used large language models to inspect its systems after hackers obtained password hashes and valid authentication tokens tied to all platform users. The incident led the company to take five listed services and product lines offline.

The offline list included KYT transaction monitoring, Address Screening, the Reactor investigation platform, Data Solutions products and Chain (Beta). Chainalysis planned to begin restoring KYT and Address Screening on Nov. 5, with access limited through an allowlist of trusted IP addresses. The phased restoration began Nov. 6 at 3:30 a.m. ET (08:30 UTC).

Chainalysis said it had contained and fixed a man-in-the-middle attack targeting some customers’ passwords. Affected accounts were to remain locked until users changed their passwords. The company required users to reset passwords and rotate API keys where applicable.

The company said it found no evidence that confidential investigation data had been accessed or blockchain attribution data altered. It also hired outside cybersecurity experts.