Chainalysis says hackers exposed credentials and live tokens

Chainalysis said hackers mounted a multifront cyberattack in October, including AI agent-assisted techniques to access its systems and internal tools. The firm reported an on-path (adversary-in-the-middle) attack that exposed a subset of passwords, and later updated that an investigation found that certain customer information—including names, usernames, password hashes and live tokens for all Chainalysis users—had been exposed to a malicious actor.

Chainalysis listed a range of high-profile customers, including government agencies such as the FBI, ICE and the US Air Force, and private sector organisations such as Microsoft, Coinbase and Barclays, although it did not state whether the data theft exposed customers to additional threats.

In its updates, Chainalysis described attempting to limit the impact by taking down its login page and its know-your-transaction service, and by removing access to its Reactor and Data Solutions services while it investigated. The company said it had begun phasing in customer access to KYT and Address Screening and asked customers to submit trusted IP addresses to be added to an allow list; it said credential rotation would be mandatory once access was restored.

It also noted that its investigation had not found evidence that investigation data or Chainalysis attribution data had been accessed or manipulated. The firm remained unclear on the exact source of the on-path access, whether the exposed data could be decrypted if traffic was monitored, and why disclosure of the data theft occurred on a later date, with no further details provided about the AI agents involved.