Chainalysis Says Names, Password Hashes and Valid Authentication Tokens of All User

Chainalysis security incident disclosure confirming exposure of user names, password hashes and authentication tokens.

Blockchain analytics firm Chainalysis has expanded its disclosure of a security breach, saying an attacker obtained the names, usernames, password hashes and valid authentication tokens of all users. The company also confirmed that some customers’ plaintext passwords were leaked through a separate attack method, according to an updated incident notice reported by Wu Blockchain.

The updated disclosure marks a significant change from the company’s initial account of the incident. Chainalysis had previously confirmed that certain customer identity information was accessed, but said it had found no evidence that passwords or session tokens had been exposed.

Chainalysis Suspended Several Services After Detecting Abnormal Activity

Following the detection of abnormal activity, Chainalysis suspended several services, including Know Your Transaction (KYT) transaction monitoring, address screening and login services. The company also required all users to reset their passwords as part of its response to the incident.

Users were additionally instructed to rotate their API keys where necessary. The measures were intended to address the exposure of authentication-related information and secure accounts following the breach.

The updated notice distinguishes between password hashes and plaintext passwords. Password hashes belonging to all users were exposed to the attacker, while plaintext passwords were leaked for some customers through a separate attack method. The disclosure does not specify how many customers were affected by the plaintext password exposure.

Updated Disclosure Revises Initial October 30 Statement

Chainalysis first disclosed the breach on October 30. At that time, the company said a hacker had used offensive AI agent technology in the attack and confirmed that certain customer identity information had been accessed.

However, the initial statement said markets Chainalysis had found no evidence that passwords or session tokens were leaked. The updated incident notice now confirms that valid authentication tokens were exposed, alongside password hashes and user-identifying information.

The two disclosures therefore reflect a broader understanding of the information accessed during the incident. The latest notice identifies exposed authentication tokens and confirms that some plaintext passwords were also compromised, details that were not established in the company's initial announcement.

Chainalysis has responded by suspending KYT transaction monitoring, address screening and login services, while requiring password resets for all users and API key rotation where necessary.

Writer: Victoria Hale
Technology & Blockchain Writer

Victoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.

She prioritises clarity and accuracy when explaining technical developments to a general audience.