Blockchain analytics firm Chainalysis has sharply widened its account of the cyberattack on its systems, now saying that names, usernames, password hashes and live tokens covering all of its users were exposed to an attacker. The update, published on 6 November, reverses the company's 30 October finding that no sign-in credentials or session tokens had been accessed.

Chainalysis first disclosed the incident on 30 October, saying an external actor had used what it described as offensive agentic techniques to access platform users' email addresses, names, role labels and user IDs. In a 4 November update to its incident page, the company said it had discovered on Monday 2 November that the exposed customer information also included password hashes and live tokens for all users. It has not said whether every type of data applies to every user. The company also said some customers' passwords were exposed in an "on-path" attack, in which an attacker sits between a user and the service.

Key services taken offline

As the investigation widened, Chainalysis took its investigation tool Reactor and its Data Solutions platform offline on 2 November as a precaution. On 4 November it also took its KYT transaction-monitoring service, both the user interface and the API, together with its other address-screening products and its login page, offline after detecting further abnormal activity.

On 6 November the company began restoring KYT and address screening in phases. Once access returns, every user will need a new password and new API keys, and customers must supply trusted IP addresses for an allowlist. Reactor and Data Solutions remained offline at the time of the update, with no date given for their return.

What was not touched