- Chainalysis says certain customer data was exposed for all users, including names, usernames, password hashes and live tokens. It does not say every data type was exposed for every user.
- On October 30 the company found no evidence of credential access. It blames 'offensive agentic techniques' but has not explained the term or said an AI agent did it.
- Customers should reset passwords and rotate API keys via the login page directly. They should also plan for a vendor's compliance tools going offline.
The label matters less than the loot
When a security vendor is breached, start with one question. What does the attacker now hold? How they got in comes second.
Chainalysis said it saw "an external actor using offensive agentic techniques." It has not explained that phrase, The Record reports. The company also stopped short of saying an AI agent carried out the breach. The wording draws attention. The facts that matter to customers lie elsewhere.
The account changed within a week
Chainalysis announced a breach on October 30. At that point it said it had no evidence that login credentials or session tokens were touched.
Its Wednesday-night update changed that. The company now says "certain customer information" was exposed for all its users. That includes names, usernames, password hashes and "live tokens." The attacker has not been identified.
There is a caveat. Chainalysis did not say whether every type of data was exposed for every user. It also did not say how many users it has.
The Record points to the company's website, which lists more than 1,500 customers. They span law enforcement, crypto firms, mainstream finance, regulators and national security.
One point is reassuring. Chainalysis says it still has no evidence that investigations data was accessed. It also sees no sign that its attribution data was altered. That is the company's own statement.
Why hashes and tokens matter
A password hash is a scrambled form of a password. The Record says some hashes can be reversed to reveal the original. Chainalysis did not say how it hashed the passwords.
A token is a digital pass issued at login. Per The Record, active tokens can let an attacker into an account with no password. Chainalysis has not defined what it means by "live tokens."
This is why the company is telling all users to reset passwords and rotate API keys. An API key is a credential that software uses to log in for a person.
Chainalysis also said some customers' passwords were exposed in an "on-path attack." That means someone intercepted traffic between users and a service. The company told customers the interception method was contained. Its email described an "ongoing multifront cyberattack" but did not name the other fronts.
Chainalysis has not said if one attacker or one method lies behind the interception, the exposed hashes and tokens, and the suspected account access.
The outage is a second exposure
On Monday, Chainalysis took its Reactor investigations tool and its Data Solutions product offline as a precaution. It kept its compliance transaction-monitoring products running.
That changed on Wednesday. The company said some accounts on its Know Your Transaction service, called KYT, appeared to have been accessed. About forty minutes after it told customers to reset passwords, it cited "abnormal activity." It then shut down KYT's user interface and API, other address-screening products and the login page. Customers who had just been told to reset passwords could not do so.
Chainalysis plans to start restoring KYT and Address Screening on Thursday. Customers must first submit trusted IP addresses for an allowlist. It gave no date for Reactor, Data Solutions or Chain (Beta). It also did not say how customers screened transactions during the KYT outage.
This part is easy to miss. Chainalysis describes these products as important for detecting money laundering. For a customer that relies on them, a vendor outage leaves a gap in its own compliance work. The breach did more than expose data. It also stopped work that customers are expected to keep doing.
Questions to put to your team
Start with exposure. Do we use any Chainalysis product? If so, who will reset passwords and rotate API keys once the login page returns? Chainalysis urges customers to go to its login page directly. It advises against following links in password-reset emails.
Then ask about dependence. Which vendor tools sit inside a regulated process? What is the manual fallback if one goes offline for days? Has anyone tested it?
Ask about the contract. Does it require a vendor to say what was exposed and to update that account as facts change? Here, the first statement was later revised to include credentials and tokens.
Finally, ask about your own keys. Can we list every API key we have issued to a vendor tool? Can we revoke each one quickly?
An attacker's label can wait. The inventory of what they hold cannot.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Record.
