Chainalysis Says Password Hashes, Live Tokens Exposed for All Users
A Nov. 4 Chainalysis update says password hashes and live tokens for all users were exposed, reversing its Oct. 30 finding. KYT and Address Screening are returning in phases behind IP allowlists; Reactor and Data Solutions stay offline.
Password hashes and live tokens for every Chainalysis user were exposed to a malicious actor, the company said in a Nov. 4 security update that sharply widens what it disclosed days earlier. It has since begun restoring compliance tools behind IP allowlists.
The company's incident post carries the update.
"On Monday, we discovered certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor"
Chainalysis
The statement reverses the picture in the Oct. 30 disclosure, which our earlier coverage reported. That notice listed user IDs, names and email addresses and said there was no evidence that authentication credentials or session tokens had been accessed. Chainalysis has not said whether every data type was exposed for every user, and it has not defined "live tokens" or disclosed the hashing method.
Services taken offline
On Nov. 2, Chainalysis took Reactor and Data Solutions offline as a precaution, while transaction monitoring continued. On Nov. 4, after abnormal activity, it took down the KYT interface and API, other address-screening products and the login page.
The company is contacting KYT customers whose accounts showed signs of unauthorized access. It has not said how many KYT accounts or users were affected.
A separate Nov. 4 update said an "on-path attack" exposed some customers' passwords. Chainalysis said that vector was contained and remediated, and it locked affected accounts pending resets.
Phased restoration
According to the sixth update, posted at 3:30 a.m. ET on Friday, Nov. 6, restoration of KYT and Address Screening has begun, one customer group at a time. Customers must first send trusted IP addresses for allowlisting. They then reset passwords and, where applicable, rotate API keys before registering transactions.
Reactor and Data Solutions remain offline with no return date. External security experts are helping harden the systems. Chainalysis says it still has no evidence that investigations data was accessed or that attribution data was manipulated, and that the incident is unrelated to the Binance theft.
Guidance for users
Chainalysis advised users not to follow links in unsolicited password reset emails and to change any reused passwords elsewhere. It recommended two-factor authentication.
The initial scoping changed within days: the Oct. 30 notice found no credential access, while the Nov. 4 update covers all users. For compliance teams that depend on KYT for transaction screening, the IP allowlist requirement and forced credential resets add steps before they can resume normal operation.
