Blockchain intelligence company Chainalysis says attackers exposed customer names, usernames, password hashes and live tokens after compromising its systems and internal tools. The company has taken its login portal and several products offline, requiring customers to use trusted IP addresses before they can regain access and reset credentials.
Chainalysis reports customer credential exposure
Chainalysis provides blockchain analysis tools used to track cryptocurrency transactions and investigate crimes including fraud, ransomware and money laundering. Its customers include law enforcement and government agencies, financial institutions, insurance companies and cryptocurrency businesses worldwide.
The disclosure follows the company’s announcement last Friday that attackers using artificial intelligence tools had employed what it called “offensive agent techniques” to access customer names, email addresses, user IDs and organizational role labels.
Chainalysis initially said the impact was limited to non-sensitive identity metadata. In a subsequent update, however, the company said usernames and password hashes for all customers had been exposed in an “on-path attack,” commonly known as a man-in-the-middle, or MITM, attack.
The company said it has found no evidence that attackers accessed survey graph data or modified its blockchain attribution repository.
“On Monday, we discovered that certain customer information, including names, usernames, password hashes, and live tokens for all Chainalysis users, had been exposed to a malicious attacker,” the company said in its Wednesday update. “At this time, there continues to be no evidence that any research data was accessed or that Chainalysis attribution data was manipulated.”
Login portal and products taken offline
After discovering that some customer passwords had been compromised, Chainalysis locked accounts as a precaution and asked users to reset their passwords before signing in again. Following the discovery of further unusual activity, the company took its login portal offline, along with its Reactor and Data Solutions products, Know-Your-Transaction (KYT) user interface and API, and address-screening products.
To prevent threat actors from accessing affected accounts, Chainalysis asked customers to provide a trusted IP address before they can access the login portal and reset their credentials.
“Please contact [email protected] or your Chainalysis account team using a trusted IP address from your allowlist. We will then grant access for users to reset their passwords and rotate API keys to register transactions. We are working around the clock to harden our systems and bring Reactor and Data Solutions back online. Additional protections will be required to access the account, such as requiring keys to be rotated,” the company added.
“Once access is granted, all users will be required to reset their passwords and rotate their API keys as needed before registering transactions,” the company said in the early hours of Friday, November 6, 2026.
Recent attacks targeting cryptocurrency companies
The Chainalysis disclosure follows several other security incidents affecting cryptocurrency companies in recent weeks. Last month, Ledger asked resellers and distributors in Asia to remove its products from shelves and stop selling the wallets while it investigated multiple hardware implant incidents.
More recently, cryptocurrency exchange Binance said North Korean hackers infected an employee’s laptop with malware during a fake job interview, compromised its wallet infrastructure and stole approximately $6.34 billion worth of cryptocurrency.
Adaptive Security’s AI agent analyzes email intent, context and behavior to uncover phishing, business email compromise and invoice fraud.
See what’s happening with a 14-day read-only scan of Microsoft 365 or Google Workspace without making any changes to MX.
Source: www.bleepingcomputer.com