Chainalysis says breach exposed credentials for all customers

A confirmed data breach at Chainalysis exposed login credentials.

Blockchain intelligence firm Chainalysis says a recent attack on its systems and internal tools has exposed credentials and live tokens for all customers.

Chainalysis provides blockchain analysis tools to trace cryptocurrency transactions and investigate crimes such as fraud, ransomware, and money laundering.

However, the company found no evidence that the attackers accessed investigative graph data or altered its blockchain attribution repositories.

While the company locked Chainalysis accounts as a precaution after discovering that some customers' passwords had been exposed and asked users to reset their passwords before signing in again, it has now taken the login portal offline, together with Reactor and Data Solutions, the Know-Your-Transaction (KYT) user interface and API, and address screening products, after discovering further abnormal activity.

We will require more protections to access accounts, including that every user will have to reset passwords and rotate API keys as appropriate, it added.

Anyone whose data Chainalysis held is potentially affected, specifically account holders whose records were exposed.

Its customer list includes law enforcement, government agencies, financial institutions, insurance companies, and cryptocurrency businesses worldwide.

While it initially said the impact was limited and the breach affected only non-sensitive identity metadata, later updates revealed that usernames and password hashes for all customers were exposed in an on-path attack (more commonly known as a Man-in-the-Middle or MITM attack).

Stolen credentials travel -- attackers routinely test them against unrelated services, which is why the exposure doesn't stop at the breached system's own doors.

To ensure threat actors don't access affected accounts, Chainalysis asked customers to provide trusted IP addresses so they can regain access to the login portal once it is brought back online and reset their credentials.

Contact support@chainalysis.com or your Chainalysis account team with trusted IP addresses for our allowlist.

The access point here was stolen login credentials, not a technical vulnerability.

We will then grant access for users to reset their passwords and rotate API keys to register transactions.

More recently, crypto exchange Binance revealed that North Korean hackers stole roughly $6.34 billion worth of cryptocurrency after compromising its wallet infrastructure by infecting an employee's laptop with malware during a fake job interview.

Chainalysis says it is still investigating the scope of what was accessed.

Ledger also asked Asian resellers and distributors last month to remove products from shelves and halt wallet sales while it is investigating multiple hardware implant incidents.

If you have any relationship with Chainalysis, watch for phishing attempts that reference this breach specifically -- stolen data often gets reused this way.

Any reused password from this account is worth changing immediately, especially on other services where the same password might still be active.

Any unsolicited message referencing this breach is worth treating with suspicion, since attackers commonly impersonate the breached company afterward.