Chainalysis says malicious actors exposed sensitive information belonging to all of its users, including names, usernames, password hashes, and live tokens. The cryptocurrency analytics company detected anomalous activity, shut down several services, and is gradually restoring access while requiring customers to rotate their credentials. Its investigation has not found evidence that research data was accessed or attribution data was altered, but key details about the attack remain unknown.
Chainalysis shuts down services after detecting anomalous activity
In an investigation conducted on Monday, Chainalysis discovered that “certain customer information, including names, usernames, password hashes, and live tokens for all Chainalysis users, had been exposed to malicious actors.” The company also detected “anomalous activity” and responded by disabling its login page and transaction confirmation service, which monitors real-time threats to cryptocurrency holdings.
Chainalysis also removed access to its Reactor and Data Solutions services while it investigated the incident.
Access is gradually being restored
In an update on Friday, Chainalysis said it was gradually restoring customer access to its Know Your Transaction (KYT) and address-screening services, with more customers expected to follow.
The company asked customers to submit trusted IP addresses so they could be added to an allowlist. Customers were also told to prepare to reset their credentials once access was restored. Credential rotation is mandatory.
Chainalysis said its investigation has not uncovered evidence that research data was accessed or that its attribution data was manipulated.
Attack details remain unclear
Several important questions remain unanswered. The source that enabled the on-path attack has not been identified. It is also unclear how useful the intercepted information would be unless the attacker could decrypt the traffic being monitored. If the attacker had that capability, the incident could have provided extensive control over the company’s infrastructure.
Chainalysis has not explained why it waited until Wednesday to disclose that its customers’ personal information had been stolen, despite the breach having been identified two days earlier. The company also did not provide details about the AI agent reportedly used in the attack or explain how it operated.
A Chainalysis representative said the company had no comment beyond the statement published in its blog post.
Source: arstechnica.com