Chainalysis Says Hack Exposed User Password Hashes, Auth Tokens; Services Suspended

Blockchain analytics firm Chainalysis disclosed that a hacking attack exposed password hashes and authentication tokens for all users to external parties. The company temporarily suspended key services to prevent further damage.

Bitcoin.com reported on November 5 that Chainalysis said in a notice it had confirmed earlier that week that customer names, usernames, password hashes and active authentication tokens had been exposed to a malicious actor.

Chainalysis said some basic customer information was leaked. It said there was no sign that authentication credentials or investigative data had been compromised. The company added that subsequent monitoring detected unusual activity in its transaction-screening system.

Chainalysis took offline the user interface and API for its Know Your Transaction, or KYT, transaction-monitoring platform, its address-screening product and its login page. It also suspended its Reactor blockchain investigation platform, data solutions products and its Chain beta service.

Chainalysis plans to restore KYT and address-screening services in phases starting November 5. Customers must allowlist trusted IP addresses before they can reset passwords and replace API keys. Password resets and API key replacements will be mandatory for all users.