Chainalysis Discloses Breach Exposed User Password Hashes and Active Tokens

Blockchain forensics provider Chainalysis expanded the reported scope of a recent cyberattack, confirming that password hashes and active tokens were exposed to an unauthorized actor ¹. The update revises an initial assessment published on Oct. 30, which had claimed that the intrusion involved only non-sensitive customer records ¹.

In an incident notice update released on Wednesday, the company stated that it discovered on Monday that customer details—including names, usernames, password hashes, and live session tokens across all user accounts—had been exposed ¹. Chainalysis did not clarify whether every user suffered the loss of all listed data categories, and the firm declined to provide details beyond its official post ¹. The previous Oct. 30 statement had acknowledged the exposure of names, email addresses, and user identifiers, but had explicitly asserted that no authentication credentials or session tokens were compromised ¹.

Remediation and Exposure Boundaries

A separate Wednesday notice clarified that an on-path attack resulted in the exposure of certain customers' passwords ¹. Chainalysis said it contained and resolved that specific attack vector, instituted account lockouts for affected users, and required mandatory password resets ¹.

The firm maintained that its core analytics products were unaffected by the breach ¹. Despite the expanded credential exposure, Chainalysis stated it detected no evidence that the attacker accessed investigative files or modified any underlying blockchain attribution data ¹. The incident follows an earlier Chainalysis security breach that drew scrutiny to operational protections around forensic infrastructure.