Chainalysis says breach exposed credentials for all customers

Chainalysis has confirmed a data breach exposing , users.

Blockchain intelligence firm Chainalysis says a recent attack on its systems and internal tools has exposed credentials and live tokens for all customers.

Chainalysis provides blockchain analysis tools to trace cryptocurrency transactions and investigate crimes such as fraud, ransomware, and money laundering.

This follows the company's disclosure last Friday that attackers using AI tools accessed customers' names, email addresses, user IDs, and organizational role labels using what it described as While it initially said the impact was limited and the breach affected only non-sensitive identity metadata, later updates revealed that usernames and password hashes for all customers were exposed in an on-path attack (more commonly known as a Man-in-the-Middle or MITM attack).

However, the company found no evidence that the attackers accessed investigative graph data or altered its blockchain attribution repositories.

While the company locked Chainalysis accounts as a precaution after discovering that some customers' passwords had been exposed and asked users to reset their passwords before signing in again, it has now taken the login portal offline, together with Reactor and Data Solutions, the Know-Your-Transaction (KYT) user interface and API, and address screening products, after discovering further abnormal activity.

Anyone whose data Chainalysis held is potentially affected, specifically account holders whose records were exposed.

Its customer list includes law enforcement, government agencies, financial institutions, insurance companies, and cryptocurrency businesses worldwide.

To ensure threat actors don't access affected accounts, Chainalysis asked customers to provide trusted IP addresses so they can regain access to the login portal once it is brought back online and reset their credentials.

Stolen credentials travel -- attackers routinely test them against unrelated services, which is why the exposure doesn't stop at the breached system's own doors.

Contact support@chainalysis.com or your Chainalysis account team with trusted IP addresses for our allowlist.

We will then grant access for users to reset their passwords and rotate API keys to register transactions.

The access point here was stolen login credentials, not a technical vulnerability.

We will require more protections to access accounts, including that every user will have to reset passwords and rotate API keys as appropriate, it added .

More recently, crypto exchange Binance revealed that North Korean hackers stole roughly $6.34 billion worth of cryptocurrency after compromising its wallet infrastructure by infecting an employee's laptop with malware during a fake job interview.

Chainalysis says it is still investigating the scope of what was accessed.

Ledger also asked Asian resellers and distributors last month to remove products from shelves and halt wallet sales while it is investigating multiple hardware implant incidents.

Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users.

If you have any relationship with Chainalysis, watch for phishing attempts that reference this breach specifically -- stolen data often gets reused this way.

Any reused password from this account is worth changing immediately, especially on other services where the same password might still be active.

Any unsolicited message referencing this breach is worth treating with suspicion, since attackers commonly impersonate the breached company afterward.