Chainalysis, a prominent blockchain analytics firm, confirmed a cyberattack that exposed data from all its users, including those from law enforcement and national security sectors. On October 30, Chainalysis first disclosed the breach but initially found no evidence of compromised credentials. However, a recent update revealed that names, usernames, password hashes, and live tokens were accessed by an unidentified attacker. The company mentioned the use of 'offensive agentic techniques' for the breach but did not elaborate on what this entailed.
Chainalysis serves over 1,500 customers across various sectors, including law enforcement and finance. The breach has necessitated that all users reset their passwords and rotate API keys. The company has engaged top cybersecurity experts to investigate and bolster its defenses. While there is no indication that investigation data or attribution data has been tampered with, some accounts on the Know Your Transaction (KYT) service have shown signs of unauthorized access.
The attack led to the temporary shutdown of multiple Chainalysis services, including KYT, Reactor, and Data Solutions. KYT's user interface and API were taken offline due to abnormal activity, and users were advised to provide trusted IP addresses to regain access. The breach reportedly involved an on-path attack, where communications between users and the service were intercepted. Although the interception method has been contained, the company remains cautious, having locked affected accounts.
Chainalysis has not clarified whether the various security incidents are linked to the same attacker or methodology, leaving many questions unanswered. As the investigation continues, users are encouraged to remain vigilant and follow the company's guidance for account security.
