Chainalysis hack exposed every user’s password hash

Chainalysis said hackers accessed the names, usernames, password hashes and live tokens of all users on its platform.

The blockchain analytics firm said on Oct. 30 that it had no evidence credentials were touched.

Live tokens leaked after an Oct. 30 notice ruled out credentials

Chainalysis detected the exposure on Monday and pulled Reactor and Data Solutions while it investigated.

The company said it still has no evidence that investigation data was accessed or that its attribution data was manipulated.

In October, an external actor used “offensive agentic techniques” to access Chainalysis systems and internal tools, and obtained user IDs, full names, email addresses and organization role labels.

The Oct. 30 notice found “no evidence of unauthorized access to investigation content, authentication credentials, or session tokens.” The attached customer e-mail also ruled out access to clear-text passwords and MFA secrets.

Police, government agencies, exchanges and banks employ Chainalysis software to track crypto and pursue fraud, ransomware and money laundering.

Chainalysis took KYT and the login page offline after abnormal activity

On Monday, Nov. 2, Chainalysis took Reactor and Data Solutions offline and hired outside cybersecurity experts to help. Customers depend on compliance transaction monitoring to find money laundering, so it stayed online.

On Nov. 4, the company told some customers by email that some of their passwords had been exposed in an “on-path attack.” It locked those accounts and told users to reset their passwords on the normal login page, telling them not to click on any links in emails that said they needed to reset their passwords.

Chainalysis later that day reported abnormal activity. It took KYT offline, including the user interface and API, along with other address screening products and its login page.

Reactor, Data Solutions and Chain (Beta) were still down. Customers whose KYT accounts appear to have been accessed without authorization are being directly notified.

On Thursday, Chainalysis will start bringing KYT and Address Screening back online. To register transactions again, customers must first add trusted IP addresses to an allowlist. They must then reset their passwords and rotate their API keys.

All users will need to change their passwords and API keys once Reactor and Data Solutions are back online. As part of a larger review of its platform security, the company is using large language models.

Cryptopolitan reported that hacking groups with ties to China have taken up ARTEX, an AI penetration testing framework that was made in China.

Chainalysis says the breach is not related to the ~$6.3 billion Binance theft, the largest crypto hack on record. Binance said that a compromised laptop of a DevOps engineer was linked to the theft.

Chainalysis posted on X on Oct. 30 that suspected North Korea-linked hacks accounted for almost 89% of all crypto hack losses reported this year. In 2021, the share was 15%.

The blockchain analysis company has counseled customers to activate two-factor authentication and be on the lookout for unsolicited password reset requests.