Stockholms Dagblad - Chainalysis Confirms Total User Data Breach in AI-Driven Cyberattack

Blockchain analytics firm Chainalysis has confirmed that a sophisticated cyberattack compromised the data of every user on its platform, exposing names, usernames, password hashes, and active authentication tokens. The breach impacts a client roster that includes the FBI, U.S. Immigration and Customs Enforcement, the U.S. Air Force, Microsoft, Coinbase, and Barclays.

The company disclosed the full scope of the incident in an update on Wednesday, expanding upon its initial report from October 30. While early notices suggested no evidence of credential access, subsequent investigation revealed that a malicious actor had gained entry to sensitive customer information. Chainalysis stated that the attacker utilized AI agent-assisted techniques to infiltrate its systems and internal tools.

The exposure includes "live tokens," which are active authentication codes that can allow an attacker to access accounts without requiring a password. Additionally, Chainalysis reported that part of the attack involved intercepting traffic along the network path, which exposed a subset of customer passwords. The company stated it had identified and fixed this specific attack vector.

The incident has forced significant operational changes for the firm. On Monday, Chainalysis pulled its Reactor investigations tool and Data Solutions product offline as a precaution. By Wednesday night, following instructions for customers to reset passwords, the company took its Know Your Transaction (KYT) service, address-screening products, and login page offline after detecting unusual activity.

Some KYT accounts appeared to have been accessed during this period. As of Friday, Chainalysis began phasing KYT and Address Screening services back online for customers. However, no restoration date has been provided for Reactor, Data Solutions, or the Chain (Beta) product.

To regain access, customers must submit trusted IP addresses to be added to an allow list. Upon restoration, mandatory credential resets and API key rotations are required. The company also urged users to navigate directly to its login page rather than clicking links in password-reset emails.

Chainalysis has hired outside cybersecurity experts to assist with the investigation. The firm stated that its inquiry has found no evidence that investigations data was accessed or that attribution data was manipulated. It has not disclosed where the on-path interception occurred or whether the captured traffic was encrypted.

Critics have noted that Chainalysis waited until Wednesday to disclose the exposure for all users, despite uncovering the issue two days earlier. The company has not explained how passwords were hashed, defined the nature of the live tokens, or provided a user count. It remains unclear whether a single attacker was responsible for the interception, exposed hashes, and suspected account access.

A Chainalysis representative declined to comment beyond its official blog post. The attack is part of a broader trend of security incidents affecting crypto-sector firms, including a separate incident where Binance reported hackers wiping evidence.

R.Nordstrom--StDgbl