A Chainalysis data breach has compromised sensitive account information for every user of the blockchain analysis platform, the company has confirmed. Names, usernames, password hashes and live tokens were all exposed to an unauthorized party, according to an update issued on Wednesday.
The disclosure follows an October security incident that Chainalysis initially described as affecting only non-sensitive customer data. That assessment changed after further investigation revealed the full scope of the intrusion.
What the attackers obtained
In a message to affected customers, Chainalysis said the intruder accessed user IDs, full names, email addresses and organization role labels. The company characterized this information as non-sensitive, though it did not explain that classification.
A subsequent update on Wednesday confirmed that a subset of customer passwords was also exposed through an on-path attack, sometimes called an adversary-in-the-middle attack. In such an attack, the perpetrator gains control of infrastructure that relays traffic between two parties.
Later that same day, Chainalysis said its investigation had uncovered that names, usernames, password hashes and live tokens belonging to all Chainalysis users had been exposed to the malicious actor.
Who uses Chainalysis
The scope of the breach is significant given the firm’s clientele. Public sources and the company itself have identified a roster of high-profile customers, including government bodies such as the FBI, US Immigration and Customs Enforcement, and the US Air Force. Private-sector clients include Microsoft, Coinbase and Barclays.
Whether the stolen data creates additional risks for those customers remains unclear.
How the attack unfolded
Chainalysis has described the incident as part of a “multifront cyberattack” that employed AI agent-assisted offensive techniques. The external actor used these methods to gain unauthorized access to company systems and internal tools.
The on-path attack vector has been identified and fixed, according to the company. However, Chainalysis has not disclosed where the infrastructure compromise occurred or whether the data obtained was protected by TLS encryption.
Without the ability to decrypt monitored traffic, the usefulness of information gathered in an on-path attack would be limited. If decryption was possible, the attackers could have gained broad control over the company’s infrastructure. Chainalysis has not addressed this question.
Service disruptions and restoration
In response to the breach, Chainalysis detected abnormal activity and took down its login page along with its know-your-transaction service, which monitors threats to cryptocurrency holdings in real time. Access to its Reactor and Data Solutions services was also removed.
On Friday, the company said it had begun phasing in customer access to KYT and Address Screening, with more customers expected to follow. Customers have been asked to submit trusted IP addresses for inclusion on an allow list and to prepare for a mandatory credential reset once access is restored.
Chainalysis said its investigation has not found evidence that investigation data was accessed or that its attribution data was manipulated.
Unanswered questions
Several key details remain undisclosed. The company has not explained why it waited until Wednesday to reveal the theft of all customers’ personal information when its investigation had discovered the exposure two days earlier, on Monday.
Chainalysis has also provided no information about the AI agents used in the attack or how they operated. A representative for the company declined to comment beyond the statements published in its blog post.
