Chainalysis says hackers took password hashes and live tokens for every user

Chainalysis, the blockchain analytics firm that police and federal agencies rely on to follow cryptocurrency, says attackers obtained names, usernames, password hashes and live login tokens for every one of its users. The company had first described the intrusion as limited to what it called non-sensitive data.

The company's customer list makes the scope of the breach serious. Chainalysis and public records have identified customers that include the FBI, U.S. Immigration and Customs Enforcement and the U.S. Air Force, along with Microsoft, Coinbase and Barclays. Those organizations use its software to trace stolen funds, flag illicit transactions and build criminal cases. Every user account on the platform has now been compromised, so the exposure runs across that whole client base.

Chainalysis has shut down its login page and several products and is requiring all users to reset their credentials. As of Friday, Nov. 6, it had begun bringing some customers back online.

How the disclosure grew over a week

Chainalysis first disclosed the incident on Oct. 30. It said it had been hit in October by an attack resembling intrusions at other tech platforms in recent weeks and stressed that the breach was "unrelated to the recent crypto theft involving Binance." The unnamed attackers used what the company called "offensive agentic techniques", meaning AI agents that helped them get into Chainalysis systems and internal tools.

That first notice was reassuring. Chainalysis said attackers had reached user IDs, full names, email addresses and organization role labels. It said it had found no evidence that investigation content, cleartext passwords, multifactor authentication secrets or session tokens were touched.

Five days later the account changed. On Wednesday, Nov. 4, the company told customers that an "on-path attack" had exposed a subset of their passwords. Also called an adversary-in-the-middle attack, this technique gives an intruder a position on infrastructure that relays traffic between two parties. "This attack vector has been contained and remediated," the company wrote to affected users. It added: "Given this sensitive and urgent information, we are requiring you to reset your password."

Later that day Chainalysis went further. It said an investigation on Monday, Nov. 2, had found that names, usernames, password hashes and live tokens for all users had been exposed to a malicious actor. It described the incident as an "ongoing multifront cyberattack."

The jump from "non-sensitive" data to every account's credentials is the part customers should care about most. Calling names, emails and role labels non-sensitive was a strange choice to begin with. For a company whose clients include investigators and intelligence-adjacent agencies, a list of who holds which role on the platform is the kind of map an attacker would want for targeted phishing.

Live tokens are probably the most dangerous item on the list. Password hashes can be strong or weak depending on how they were generated, and Chainalysis hasn't said which hashing method it used. A valid session token, though, can often let someone act as a user without knowing the password at all. That explains why the company is forcing credential rotation instead of just recommending it.

Services offline and the road back

Around the time of the Wednesday disclosures, Chainalysis took down three products, Reactor, Data Solutions and Chain (Beta), "out of an abundance of caution." It also pulled its KYT (know your transaction) interface and API, other address-screening products and its login page "due to abnormal activity." KYT monitors cryptocurrency transactions for risk in real time. Exchanges and other businesses use tools like it to screen funds as they move, so an outage has consequences beyond the inconvenience.

On Friday, the company said it had started phasing customers back into KYT and Address Screening and expected more to regain access over the next several hours. It said it was moving carefully and watching each phase. Customers who want access sooner are being asked to email their trusted IP addresses so they can be added to an allow list. They should also be ready to reset their credentials once they log in. Resetting passwords is mandatory, and the company says users should rotate API keys where appropriate.

Reactor, the investigation tool that many agencies use to trace funds across blockchains, and Data Solutions were still offline. Chainalysis said it was working "around the clock" to harden its systems and restore them.

The IP allow list is a sensible stopgap. It limits who can even reach the login page while the company rebuilds trust in its authentication. It also adds work for large customers with distributed teams, and it shows how little Chainalysis is willing to take on faith right now.

What Chainalysis says wasn't touched

The company's most important claim is that its investigation has found no evidence that anyone accessed investigation data or tampered with Chainalysis attribution data. Attribution data links blockchain addresses to real-world entities such as exchanges, scam operations or sanctioned groups, and it is the core of what Chainalysis sells. If someone altered those labels, investigators could be pointed at the wrong targets or steered away from the right ones. Investigation files hold case notes and graphs that could reveal what law enforcement knows.

"No evidence" carries more weight here because of how the disclosures have gone so far. The first notice also found no evidence that tokens or credentials were compromised, and that turned out to be wrong. Customers will likely want independent verification before treating the integrity claim as settled. The company hasn't said whether it will provide that.

Several basic questions are still open. Chainalysis hasn't said where the on-path compromise happened or whether the intercepted traffic was protected by TLS encryption. That detail matters. Intercepted encrypted traffic is of limited use unless the attacker can decrypt it, and decryption would suggest much deeper control of the company's infrastructure. Chainalysis also hasn't explained why two days passed between finding the full exposure on Monday and telling customers on Wednesday. It hasn't described how the AI agents used in the attack worked either.

A Chainalysis representative told Ars Technica that the company wasn't commenting beyond the statements in its blog post.

As of Friday, no group had claimed responsibility, and TechRadar reported that the stolen data had not surfaced on the dark web. Chainalysis has not said whether the attackers have contacted it. The company built its reputation on helping investigators follow attackers' money. How quickly and fully it explains its own breach will shape whether those clients keep trusting the data it gives them.