Chainalysis Broadens Breach Disclosure to Include Password Hashes and Live Tokens

Blockchain analytics provider Chainalysis has expanded its disclosure of a recent cyberattack, confirming that sensitive user authentication data was exposed. The firm initially reported on Oct. 30 that only basic customer information was compromised [1, 2]. However, an update issued on Wednesday revealed that names, usernames, password hashes, and live tokens were accessible to a malicious actor ².

Escalating Disclosure

The initial notice from Chainalysis stated the intrusion involved "non-sensitive customer data" such as user IDs and email addresses, explicitly denying evidence that authentication credentials or session tokens were accessed [2, 3].

By Nov. 6, the company reversed that assessment in an updated incident notice ². Chainalysis confirmed the exposure of password hashes and live tokens for all users ². The company declined to clarify if every user had all data types exposed ².

Attack Methods and Mitigation

The breach involved an “on-path attack” that compromised some customer passwords ². Chainalysis reported that it has contained this specific vector, locking affected accounts and mandating password resets ².

Earlier communications described the attacker as using "offensive agentic techniques" to breach internal tools ³. In response, Chainalysis stated it is employing large language models to assist with a comprehensive security review and has engaged external cybersecurity specialists [1, 3].

Uncompromised Case Files

Despite the broader scope of exposed credentials, Chainalysis maintains that investigation data remains secure ². The firm stated there is no evidence that attackers manipulated attribution data or accessed case materials such as graphs, query results, and notes [2, 3]. The company also clarified the incident is unrelated to a separate cryptocurrency theft involving Binance [1, 3].