Chainalysis warns all users hit in cyber breach involving ‘agentic’ techniques

Chainalysis, the blockchain analytics company, said Wednesday night that some information belonging to all its users — which its website says include those in the law enforcement and national security sectors — had been exposed in a cyberattack.

The company initially disclosed a breach on Oct. 30, although at the time said it had found no evidence that authentication credentials or session tokens had been accessed.

In its latest update, posted Wednesday night, the company said it had discovered “certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor.”

The perpetrator was not identified. Chainalysis previously said it had “detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools.” It has not explained what it meant by “offensive agentic techniques.”

The company initially told customers the breach came amid what it described as “an industry-wide rise in AI-driven cyberattacks.” Although it initially mentioned agentic techniques, it did not explicitly say its own breach was caused by an AI agent.

Chainalysis said it had engaged “world-class third-party cybersecurity experts” to help investigate the incident and strengthen its defenses.

Its statement did not specify whether every category of information was exposed for every user, nor did it say how many users it has.

According to its website, Chainalysis says it provides services to more than 1,500 customers across sectors including law enforcement, cryptocurrency and regular finance, regulators and national security.

“At this time we continue to have no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated,” the company said Wednesday night.

All users will have to reset their passwords and rotate API keys as appropriate, the company said, also urging affected customers to visit its login page directly rather than follow links in password-reset emails.

Chainalysis did not explain what it meant by “live tokens” nor say how the exposed passwords had been hashed. Certain password hashes can be cracked to recover the original password, while active authentication tokens may allow attackers to access accounts without passwords.

The company also said Wednesday night that some customers' accounts on its Know Your Transaction service (KYT) — used to monitor cryptocurrency transactions for suspicious activity — appeared to have been accessed.

The suspected account access was disclosed amid widening disruption to the company’s services as Chainalysis provided updates on its ongoing investigation. 

The company said some customers’ passwords had been exposed in an “on-path attack,” in which an attacker intercepts communications between users and a service.

An email to affected customers described an “ongoing multifront cyberattack” but did not identify the other fronts. It said the interception method had been contained and remediated, affected accounts were being locked and there was no evidence they had been accessed improperly.

Forty minutes later, Chainalysis said “abnormal activity” had prompted it to take KYT's user interface and API, other address-screening products and its login page offline.

Customers who had just been instructed to reset their passwords were told doing so was not immediately possible.

The shutdown expanded restrictions imposed Monday, when the company took its Reactor investigations tool and Data Solutions product offline as a precaution but kept its compliance transaction-monitoring products running. Chainalysis describes those products as important to detecting money laundering across the cryptocurrency ecosystem.

The company said it planned to begin restoring KYT and Address Screening on Thursday, after customers submitted trusted IP addresses to be added to an allowlist. Customers would then be able to reset passwords and rotate API keys.

It gave no date for restoring Reactor, Data Solutions or another product, Chain (Beta), and did not explain how customers were screening transactions while KYT was offline.

Chainalysis has also not said whether the password interception, exposure of hashes and tokens, and suspected unauthorized account access involved the same attacker or methods.

A spokesperson said they were unable to share more information than was provided in the blog.