Chainalysis Reveals Password Hashes and Valid Authentication Tokens Exposed in Security Breach

Chainalysis says attackers accessed names, usernames, password hashes and valid tokens, while some customers’ plaintext passwords were also exposed.

Chainalysis has expanded its disclosure of a security breach, confirming that attackers obtained names, usernames, password hashes and valid authentication tokens belonging to all users. The blockchain analytics firm also revealed that some customers’ plaintext passwords were exposed through a separate attack method.

The updated security incident notice provides a broader account of the information compromised than the company initially disclosed. It confirms that the exposure extended beyond customer identity information to Wu Blockchain include authentication-related data, raising the significance of the incident for users accessing Chainalysis services.

Chainalysis Suspends Services and Requires Password Resets

Following the detection of abnormal activity, Chainalysis suspended several services as part of its response. The affected services included Know Your Transaction (KYT) transaction monitoring, address screening and login services.

The company also required all users to reset their passwords. In addition, users were instructed to rotate their API keys where necessary. These measures were outlined in the updated incident notice as part of the company's response to the exposure.

The disclosure that valid authentication tokens were accessed is a significant addition to the incident report. Unlike information such as names and usernames, authentication tokens are used in access-related processes. Chainalysis confirmed that valid tokens belonging to all users had been exposed to the attacker.

The company further stated that some customers' plaintext passwords were leaked through a separate attack method. This detail distinguishes the password exposure from the disclosure of password hashes and indicates that the incident involved more than one method of obtaining user authentication information.

Earlier Disclosure on October 30

Chainalysis first announced the breach on October 30, when it disclosed that a hacker had used offensive AI agent technology in the attack. At that stage, the company confirmed that certain customer identity information had been accessed.

However, the initial announcement said Chainalysis had found no evidence that passwords or session tokens had been leaked. The updated notice subsequently provided additional information, confirming that password hashes and valid authentication tokens had been exposed, while some plaintext passwords were also compromised through a separate attack method.

The difference between the initial disclosure and the updated notice reflects the expanded scope of information confirmed by the company as it continued addressing the incident. The latest statement identifies the categories of user information exposed and details the service suspensions and account-security measures required in response.

Chainalysis's updated notice confirms that the exposure affected information associated with all users, while the plaintext password disclosure applied to some customers. The company required password resets for all users and API key rotation where necessary.

Writer: Victoria Hale
Technology & Blockchain Writer

Victoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.

She prioritises clarity and accuracy when explaining technical developments to a general audience.