Summary
- New disclosures identify exposure of password hashes and live tokens associated with Chainalysis users.
- The company has reported possible unauthorised access to some KYT customer accounts.
- Security-related service restrictions have affected cryptocurrency investigation and compliance-monitoring tools.
Blockchain intelligence company Chainalysis has expanded its assessment of a cyberattack after identifying exposure of password hashes and live authentication tokens associated with its users, substantially increasing the potential consequences of an incident initially described as involving less sensitive customer information.
The company has also reported suspected unauthorised access to some customer accounts on its Know Your Transaction platform, while security-related disruption has affected services used by financial institutions, cryptocurrency businesses, and investigators.
In an updated customer disclosure issued on 4 November, Chainalysis said information including names, usernames, password hashes, and live tokens associated with all users had been exposed to a malicious actor.
The company has not established publicly whether every category of information was exposed for every account, nor has it explained the format and intended function of the affected tokens.
Those distinctions are important because different credentials present different levels of risk depending on their protection, validity, and permissions.
New findings expand the original disclosure
Chainalysis initially disclosed the incident on 30 October, reporting unauthorised access to internal systems and tools.
At that stage, the company said investigators had found no evidence that authentication credentials, session tokens, investigation content, or certain other sensitive information had been accessed.
It acknowledged exposure of customer account information, including user identifiers, names, email addresses, and organisational role labels, while continuing to investigate the scope of the intrusion.
The latest customer communications materially change that position by identifying password hashes and live tokens among the information exposed.
Password hashes are not equivalent to passwords stored in readable form. Their susceptibility to recovery depends on the hashing method, the strength of individual passwords, and other protective measures.
Live tokens introduce a different possible exposure because certain authentication tokens can permit access to an account or service without requiring the original password. Whether the affected Chainalysis tokens could be used in that way has not been publicly established.
The company has also disclosed an interception incident involving a subset of customer passwords. It described that activity as an on-path attack and said the relevant method had been contained and remediated.
Chainalysis has not confirmed whether the interception activity, the wider exposure of hashes and tokens, and the suspected unauthorised account access involved the same attacker or technical mechanism.
The original incident was described by the company as involving offensive agentic techniques. It has not provided sufficient technical detail to establish the precise role of artificial intelligence or automated tooling in the intrusion.
Security response interrupts compliance services
The consequences have extended beyond the exposure of account information into the availability of Chainalysis services.
Earlier in the investigation, the company took its Reactor investigation product and Data Solutions service offline while carrying out additional security assessments.
It initially maintained access to its compliance-monitoring products because customers depend on those systems to identify suspicious cryptocurrency activity and support anti-money laundering processes.
However, subsequent abnormal activity prompted Chainalysis to take its Know Your Transaction interface and API offline, alongside other address-screening products and its login service.
These restrictions affected the ability of customers to use established screening and investigation workflows, creating a separate operational problem from the potential misuse of compromised credentials.
Know Your Transaction is used to assess the risks associated with cryptocurrency transfers. Interruptions may require affected customers to review alternative monitoring arrangements, transaction-handling procedures, and escalation processes while the service is unavailable.
The impact will depend on each organisation’s reliance on Chainalysis, its available alternative controls, and the requirements applying to its activities.
The company planned a controlled restoration of Know Your Transaction and Address Screening access using trusted customer IP addresses, followed by password resets and API-key rotation where appropriate.
That process reflects the difficulty of restoring account access during an active investigation. Reopening services before authentication controls are secured can create further exposure, while prolonged restrictions may interrupt legitimate financial crime monitoring.
Chainalysis has said it has no evidence that investigation data was accessed or that its blockchain attribution information was manipulated. Those statements address the integrity and confidentiality of particular services, rather than the separate credential exposure now identified.
The company continues to work with external security specialists and is notifying customers whose accounts appear to have been accessed without authorisation.
The full relationship between the different reported attack methods, the number of accounts actually misused, and the eventual operational impact remain under investigation.
