Chainalysis Confirms Hackers Stole Live Tokens, Password Hashes in October Breach

Blockchain analysis firm Chainalysis has confirmed that attackers who breached its systems in October managed to steal live cryptocurrency tokens and password hashes, in addition to previously disclosed user data. The company, a leader in blockchain analysis with a significant global customer base including law enforcement agencies, revealed the expanded scope of the breach in an update late Wednesday.

Previously, Chainalysis had disclosed that attackers gained unauthorized access to user IDs, full names, email addresses, and organizational role labels. The confirmation of stolen password hashes and live tokens represents a significant escalation of the incident's impact. While the company did not specify the hashing algorithm used for passwords, making it difficult to assess the offline crackability of credentials, it did advise users to change passwords on any site where they reuse credentials. Some users received emails prompting password changes, though the password reset functionality itself was reported as down.

The attackers employed "offensive agentic techniques" and an "on-path attack" to gain access to internal tools. Chainalysis detected "abnormal activity" on its transaction screening products, leading to the temporary shutdown of critical services. These include the Reactor blockchain investigation platform, the Data Solutions threat intelligence platform, and the KYT (know your transaction) anti-money laundering solution.

Despite the intrusion into these sensitive platforms, Chainalysis stated it has "no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated." The company is working to restore services, including KYT and the Address Screening tool, with enhanced security measures. Customers will need to provide trusted IP addresses for an allowlist before they can reset passwords and rotate API keys.

Chainalysis has not attributed the attack to a specific threat actor but noted the use of "agentic techniques," a method observed in recent attacks against other tech platforms. The company described the intrusion as an "ongoing multifront cyberattack" and an "on-path attack," also known as a man-in-the-middle attack.

Chainalysis serves government agencies, cryptocurrency exchanges, financial institutions, and cybersecurity companies. The firm regularly assists in cyber-related law enforcement investigations, including recent efforts against the LockBit ransomware operation and crypto-laundering networks. The breach raises concerns about the security of sensitive blockchain data and the tools used by law enforcement to track illicit financial activities.

The company is working with external experts to restore its services securely, emphasizing the business-critical nature of its platforms. The incident underscores the evolving threat landscape and the sophisticated methods employed by attackers targeting critical infrastructure in the cybersecurity and financial sectors.