Hackers stole credentials for every Chainalysis customer

Chainalysis, the blockchain analysis firm that sells cryptocurrency tracing to the FBI, US Immigration and Customs Enforcement, the Air Force, Microsoft, Coinbase and Barclays, has disclosed that hackers obtained names, usernames, password hashes and live session tokens for all of its users.

The company first described the October incident as a cybersecurity event involving "AI agent-assisted offensive techniques," and initially labelled the exposed customer data "non-sensitive" — a category that apparently included full names, email addresses and organization role labels. A later update admitted an "on-path attack" had exposed a subset of customer passwords, and a subsequent investigation revealed that credentials and live tokens for every Chainalysis user had been exposed to a malicious actor. The company has taken down its login page and its know-your-ctransaction monitoring service, and is requiring mandatory credential rotation, with customers asked to submit trusted IP addresses for an allow list.

The reversal between "non-sensitive customer data" and "password hashes and live tokens for all users" took two days, and the company has not explained the gap. Nor has it said where the on-path attack occurred — that is, which piece of infrastructure between customers and Chainalysis was compromised — or whether the intercepted traffic was encrypted. If the attackers could decrypt what they monitored, they may have gained broad control of the company's infrastructure. The company says it has found no evidence that investigation data was accessed or attribution data manipulated.

The customer list is the story. Chainalysis is the dominant vendor of chain-analysis services to governments and exchanges across the world; when police trace a wallet, when a regulator attributes a hack, when an exchange screens a deposit, the underlying intelligence frequently runs through this one company. A breach of its perimeter is not a breach of one firm — it is a breach of every investigation it touches, and potentially a map of which agencies are watching which addresses.

Ars Technica notes several questions remain unanswered, including what the "AI agents" in the attack actually did and how they worked. Chainalysis has declined to comment beyond its blog posts.

A firm that charges premiums for monitoring everyone else's transactions discovered the exposure of its own customers' credentials on a Monday, and told them on a Wednesday.