✓ Verified by 5+ outlets
Chainalysis discloses a security breach that exposed customer names and emails
⚪NeutralWider credential and token exposure plus temporary KYT/login outages hit a major analytics vendor’s customers, but the company still reports no evidence investigation or attribution data was accessed or altered, so there is no clear directional read on liquid crypto assets.News sentiment, not financial advice. It reflects the likely impact of this news, not a price prediction.
Summary
Blockchain analytics firm Chainalysis said it was hit by a cybersecurity incident that exposed some non-sensitive customer data, including user IDs, names and email addresses, Cointelegraph and The Block reported.
The Block reported that Chainalysis said the hacker used "offensive agentic techniques" to access the data.
In a blog post on Friday, Chainalysis said its investigation so far found no evidence of unauthorized access to investigation content, authentication credentials or session tokens, according to Cointelegraph.
The company said the incident was not related to the recent theft at Binance, which Chainalysis has been tracking, Cointelegraph reported.
Updates
- Update, : Update (Nov. 6, 9pm): Chainalysis’s incident blog and Cointelegraph said a Nov. 4 update disclosed that names, usernames, password hashes and live tokens for all Chainalysis users were exposed—wider than the Oct. 30 claim of only non-sensitive IDs/names/emails. Separately that day the firm said an on-path attack exposed a subset of customer passwords, locked affected accounts and required resets; it then took KYT (UI and API), other address-screening products and the login page offline after abnormal activity, and said it was notifying customers whose KYT accounts appeared accessed without authorization. A Nov. 6 early-morning blog update said phased restoration of KYT and Address Screening had begun, with password resets and API-key rotation required; Reactor and Data Solutions remained offline. Chainalysis still reported no evidence that investigation content was accessed or attribution data manipulated. Ars Technica and BleepingComputer independently covered the wider credential/token disclosure.
Key facts
- Chainalysis said it engaged third-party cybersecurity experts and is using large language models to help review its security and strengthen its defenses, Cointelegraph reported.
- Chainalysis said the Binance attackers are using a Tron protocol to dodge stablecoin freezes, according to The Block.
- Chainalysis posted on X that suspected North Korea-linked hacks made up almost 89% of reported crypto hack losses this year, up from 15% in 2021, Cointelegraph reported.
- Chainalysis (Nov. 4, 11:00 p.m. EST blog update): Discovered Monday that names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor; removed access to Reactor and Data Solutions; no evidence investigations data accessed or attribution data manipulated.
- Chainalysis (Nov. 4): After abnormal activity, took KYT (UI and API), other address-screening products and the login page offline; directly notifying customers whose KYT accounts appear to have been accessed without authorization.
- Chainalysis (Nov. 4, 9:50 a.m. EST): On-path attack exposed a subset of customer passwords; attack vector contained/remediated; accounts locked and password resets required.
- Chainalysis (Nov. 6, 3:30 a.m. EST): Began phased restoration of KYT and Address Screening; users must submit trusted IPs for allowlist, then reset passwords and rotate API keys; Reactor and Data Solutions still offline pending further hardening.
- Cointelegraph: Contrasted the Nov. 4 wider disclosure with the Oct. 30 statement that only non-sensitive customer data (user IDs, names, emails) was accessed and that there was then no evidence authentication credentials or session tokens were accessed.