Chainalysis Reveals Exposure of Data of All Its Users, Suspends Investigation and Compliance Products
Key Facts
Chainalysis said in an update published Wednesday evening, November 4, that it had discovered usernames, password hashes and “live tokens” for all its users had been exposed to an attacker, broadening the scope of information it had disclosed about the incident. The company suspended its KYT interface and API, other address-screening products, and its login page after detecting unusual activity. It had suspended Reactor and Data Solutions during the investigation, according to its updates. The company said some customer accounts on KYT appeared to have been used without authorization, and that it was notifying the customers concerned directly. These measures put transaction-monitoring tools that the company says are important to its customers, particularly for detecting money laundering, at the center of its response to the incident.
The company said it had no evidence that the attacker accessed investigation data or tampered with blockchain address attribution data. In a message to one customer, it said an attack involving connection interception exposed passwords belonging to a subset of customers, and that this route had been contained and addressed. According to the message, it had no evidence of unauthorized access to the affected accounts at that time. The scope of this disclosure differs from the broader set of data the company said was exposed to an attacker, since the announcement does not establish that passwords in plaintext were exposed for every user. The company also did not explain what it meant by “live tokens” or how passwords were hashed, and did not specify whether each category of data was exposed for every user.
In its initial disclosure, published on October 30, Chainalysis said it had found no evidence of unauthorized access to investigation content, credentials or session tokens. The November 4 update disclosed the exposure of password hashes and live tokens, as well as usernames, while investigation data and attribution data remained outside the scope of what the company said it had detected. The Record described the attacker as unknown and quoted the company as saying it had detected an external party using “offensive and proxy techniques” to access internal systems and tools without authorization. The company did not provide a technical explanation of these techniques in the disclosures cited. The differing scopes of the disclosures mean the company presented additional information in its later update about the data exposed, following its initial statement on the investigative findings available at the time.
Chainalysis provides services to more than 1,500 customers, according to The Record, which cited the company’s website. The sectors mentioned include law enforcement, cryptocurrency, traditional finance, regulators and national security. The suspension of KYT and address screening makes the incident relevant to customers using the company’s products to monitor transactions, but Chainalysis did not specify the impact of the disruption on customers. The Record also did not explain how customers continued screening transactions while KYT was suspended. The disclosures do not provide a timeline for restoring Reactor, Data Solutions or Chain (Beta), which the report said were suspended. The company said it was working to strengthen its systems and restore Reactor and Data Solutions.
Chainalysis said it intended to begin restoring KYT and address screening on the day after its November 4 update. It asked customers to submit trusted IP addresses to be added to an allowlist before access was restored. After that, it said it would let users reset their passwords and rotate their API keys. The company did not set a timeline for restoring Reactor or Data Solutions, and The Record did not give a date for the return of Chain (Beta). According to the company’s announcement, these steps are the stated path to restoring screening products, while it continues to contact directly customers whose KYT accounts appear to have been used without authorization.