Major hack at Chainalysis: login details of all users leaked

Blockchain analysis company Chainalysis has been hit harder by a cyber attack than initially thought. Hackers have not only seized customer data, but also sensitive login credentials and active access tokens.

The data breach affects all users of the platform. Chainalysis has shut down several important services as a precaution.

Chainalysis first reported on October 30 that hackers had gained access to customer data. This included names, email addresses and user numbers.

The company emphasized at the time that there was no evidence that passwords or active access tokens had been stolen.

On Wednesday 4 November, however, Chainalysis came up with a worrying update. Further investigation revealed that the attackers had also taken usernames, encrypted password data, and active access tokens from all users.

The latter, in particular, is a risk. Such tokens allow systems to recognize users without them having to log in again and again. If hackers can misuse the tokens, they may gain access to accounts.

The company also discovered a separate attack that intercepted communications between users and the platform. As a result, the passwords of some customers also came into the hands of the attackers.

Chainalysis has now blocked the attack method used. It is not yet clear to what extent the stolen data has actually been misused.

The attack has major consequences for Chainalysis' services.

The company already switched off Reactor and Data Solutions earlier this week. These are services that are used, among other things, to investigate crypto transactions and analyse blockchain data.

Later, suspicious activity was also discovered at Know Your Transaction (KYT), a system that crypto companies use to check transactions for possible fraud and money laundering.

As a result, Chainalysis also decided to temporarily take KYT and other monitoring services offline.

According to the latest update of Friday 6 November, access to KYT and Address Screening is now being gradually restored.

Users must reset their passwords and replace their API keys where necessary. This gives external systems access to the services of Chainalysis.

Affected accounts have been blocked as a precautionary measure until security is restored.

The attack is particularly sensitive because Chainalysis is used by crypto exchanges, banks and investigative services worldwide.

Among other things, the company helps to detect stolen crypto coins, money laundering and suspicious cash flows.

To this end, Chainalysis has valuable information that can be used to link blockchain addresses to individuals and organisations.

According to the company, there is no evidence so far that hackers have gained access to research data. Also, there are no indications that data on the identity behind blockchain addresses has been modified.

That does not mean that the investigation has been completed. Chainalysis is still working with external security experts to determine the full scope of the attack and securely restore its services.