Chainalysis says breach exposed data for all users

On Nov. 4, Chainalysis said information including names, usernames, password hashes and live tokens for all its users had been exposed to a malicious actor. The blockchain analytics firm has not said how many users that means or whether every listed data type was exposed for each person, and several services were taken offline during its response.

In its security incident updates, Chainalysis said it discovered the exposure on Monday, two days after its first notice said it had found no evidence that credentials or session tokens were accessed. The company said it still had no evidence that investigation data was accessed or its attribution data manipulated.

What could the exposed data let an attacker do?

Chainalysis has not explained what it means by “live tokens” or disclosed how the password hashes were created. A hash is a scrambled version of a password; depending on how it was made, attackers may be able to try to recover the original. A live token can sometimes let someone access an account without entering its password, but Chainalysis has not specified what these tokens permit.

The company separately said an “on-path attack” exposed passwords for a subset of customers. That means an attacker intercepted communications between users and the service. Chainalysis said it had contained and fixed that method, locked affected accounts and required password resets.

The Record from Recorded Future News reported that the company had not identified the attacker or said whether the password interception, the exposure of hashes and tokens, and suspected account access used the same method. Chainalysis said some customer accounts on its Know Your Transaction service appeared to have been accessed without authorization, and that it was contacting those customers directly.

Which services are back, and what must customers do?

As of Nov. 7, Chainalysis says Reactor, KYT and Address Screening are back online with additional security measures. Its latest update did not say that Data Solutions had returned; on Nov. 6, it said it was still working with outside security experts to restore Reactor and Data Solutions.

Customers must follow the company’s reconnection instructions. Chainalysis says users will have to reset passwords and rotate API keys where applicable before registering transactions; it has also asked customers to submit trusted IP addresses for an allowlist. The company says it is emailing instructions, so customers need to check those messages against their usual account contacts and follow the firm’s advice to go directly to its login page rather than use password-reset links in unsolicited emails.

The outage interrupted tools used to investigate crypto activity and screen transactions, so customers had to wait for access or use their own alternatives while services were offline. Chainalysis has not disclosed a financial cost, a count of affected accounts or the impact on customers’ operations.

What should readers watch next?

The next signal is Chainalysis’s next incident update: whether Data Solutions returns, what the firm says about the exposed tokens and hashes, and whether it provides more detail on unauthorized KYT access. Until then, customers should follow the company’s reconnection steps and watch for its direct notices.

Source material

• security incident updates — chainalysis.com
• reported that the company had not identified the attacker — therecord.media