Chainalysis Says Attack Exposed Password Hashes and Active Tokens

Chainalysis disclosed that attackers had access to every user’s name, username, password hash and active authentication token, and is requiring all users to reset their passwords. Some customers’ plaintext passwords were also compromised through a separate attack method; API key changes may be necessary.

Chainalysis suspended three services after detecting abnormal activity: transaction monitoring (KYT), address screening and login. Its reset order covers the full user base, while plaintext password compromise affected some customers. API key changes may be necessary.

The revised disclosure expands on Chainalysis’ Oct. 30 notice. At that time, the company had confirmed access to some customer identity information and said it had found no evidence that passwords or session tokens were exposed. The updated notice identifies password hashes and active authentication tokens as exposed for all users, alongside plaintext passwords compromised for some customers.

The Oct. 30 notice described the intrusion as involving hackers using offensive AI-agent technology.