Chainalysis shuts key services after user credentials are exposed

Chainalysis has disclosed that an ongoing cyber incident—described as an “ongoing multi-front cyber attack” with an on-path component—also exposed sensitive credentials for all users. The firm said that names, usernames, password hashes and live tokens for its users were accessed during the attack while investigators continued to assess the impact. In response, Chainalysis shut access to its Reactor and Data Solutions products and implemented enhanced monitoring.

The Know Your Transaction (KYT) user interface and API were taken offline, along with other address screening tools and the login page, to limit further exposure. The company emphasised that there is no evidence that investigations data or Chainalysis attribution data have been accessed or manipulated to date, but it has locked affected accounts as a precaution.

Chainalysis said it would begin restoring access to KYT and Address Screening and urged customers to contact support or their account teams with trusted IPs to be added to an allowlist. Customers who recently received password reset instructions were told that resetting passwords would not be possible immediately, and the firm advised users to rotate API keys and reset credentials on other systems if they reuse them elsewhere.

The investigation is ongoing, and Chainalysis stated that it is “working around the clock to harden our systems and bring Reactor and Data Solutions back online,” adding that additional protections will be required for access going forward. The company did not identify a definite actor behind the incident, stating it was similar to targets observed on other tech platforms in recent weeks.