Chainalysis began a phased restoration of customer access to Know Your Transaction (KYT) and Address Screening on November 6. The company’s investigation had found names, usernames, password hashes and live tokens exposed for all Chainalysis users, according to the company as reported by Ars Technica.
The all-user finding and the password exposure through an on-path attack had different scopes.
What Chainalysis said was exposed
Chainalysis said an external actor used AI agent-assisted techniques to gain unauthorized access to its systems and internal tools during an incident in October. The company’s later investigation found that names, usernames, password hashes and live tokens for all its users had been exposed to a malicious actor.
An earlier customer notice listed user IDs, full names, email addresses and organization-role labels for users provisioned on the platform. Chainalysis also said its investigation found no evidence that investigation data had been accessed or its attribution data manipulated.
A separate attack affected some customer passwords
An on-path attack, in which an attacker accesses infrastructure carrying traffic between parties, exposed a subset of customer passwords. Chainalysis said it identified and fixed that attack vector. This finding concerned a subset of passwords; the company’s later investigation covered four categories of information for all users.
Service access and customer steps
After detecting abnormal activity, Chainalysis took its login page and KYT service offline and removed access to Reactor and Data Solutions. On November 6, the company began phasing customer access back to KYT and Address Screening. Its incident page carried the label “Updated Nov. 7,” according to Chainalysis.
Chainalysis asked customers to provide trusted IP addresses for an allowlist and said credential rotation would be mandatory after access returned.
