Chainalysis says hackers obtained names, password hashes and live tokens for all its users
Blockchain analysis firm Chainalysis said that hackers obtained sensitive personal information for all of its users after a breach of its network security. The data includes names, usernames, password hashes and live tokens, according to Ars Technica's account of the company's statements.
The disclosure came in stages. Last Friday, Chainalysis said it had been the target of a cybersecurity incident in October, one it described as similar to the hacks of other platforms during the same month. The company said the external actor used AI agent-assisted offensive techniques to gain unauthorized access to Chainalysis systems and internal tools. An email sent to affected customers said some "non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform were accessed." Ars Technica notes it is not clear why the company considered such information non-sensitive.
In a Wednesday update, Chainalysis said that part of what it called an "ongoing multifront cyberattack" involved an "on-path attack" that exposed a subset of customer passwords. It said the attack vector had been identified and fixed. An on-path attack, also known as an adversary-in-the-middle attack, happens when a hacker gains access to a piece of infrastructure that carries traffic back and forth between two parties. Chainalysis has yet to say where the infrastructure compromise occurred or whether the data obtained from it was TLS encrypted.
Ars Technica says the breach could be a major coup for the attackers, given the long list of high-profile customers revealed by Chainalysis and public sources. They include government agencies such as the FBI, US Immigration and Customs Enforcement and the US Air Force, and private companies such as Microsoft, Coinbase and Barclays. It is unclear whether the data theft exposed customers to additional threats.
Key facts
- Chainalysis says hackers obtained names, usernames, password hashes and live tokens for all of its users after a breach of its network security.
- The company says the October incident was similar to hacks of other platforms that month, and that the external actor used AI agent-assisted offensive techniques to reach its systems and internal tools.
- A Wednesday update described an "on-path attack" that exposed a subset of customer passwords; Chainalysis says the attack vector has been identified and fixed.
- Chainalysis has not said where the infrastructure compromise occurred or whether the data was TLS encrypted.
- Chainalysis customers include the FBI, US Immigration and Customs Enforcement, the US Air Force, Microsoft, Coinbase and Barclays; it is unclear whether the theft exposed customers to further threats.
Why it matters
Chainalysis sells blockchain analysis to government agencies and private companies, so a breach of its user data is a concern well beyond one vendor. Ars Technica calls the accomplishment a potential major coup for the attackers, given a customer list that includes the FBI, US Immigration and Customs Enforcement and the US Air Force, plus Microsoft, Coinbase and Barclays. The company also says the attacker used AI agent-assisted offensive techniques, and describes the incident as similar to hacks of other platforms in the same month.
Who it affects
Chainalysis says the stolen personal information covers all of its users. Its customers include government agencies such as the FBI, US Immigration and Customs Enforcement and the US Air Force, and companies such as Microsoft, Coinbase and Barclays. The article does not say that any of these named customers was individually confirmed as affected. Separately, an on-path attack exposed a subset of customer passwords.
How to use it
This is an incident report, not a product, so there is nothing to adopt. The article gives no remediation steps for customers such as password resets or token revocation. What it does say: Chainalysis told affected customers by email that user IDs, full names, email addresses and organization role labels were accessed, and later said the attack vector behind the on-path attack was identified and fixed. Chainalysis customers should watch for further updates from the company.
How solid is it
The core claims come from Chainalysis itself: its Friday disclosure, its email to affected customers and its Wednesday update. Ars Technica reports them and adds its own explanation of on-path attacks. Some pieces are firm, such as the company saying the vector was identified and fixed. Others are open: the article gives no exact dates beyond "last Friday", "Wednesday" and "October", and no number of affected users. It also does not identify the attackers or detail the AI agent-assisted techniques.
Risks and caveats
Password hashes and live tokens are the kind of data that can matter for account access, but the article does not say whether the hashes were cracked or the tokens abused. Ars Technica says it is unclear whether the theft exposed customers to additional threats. Chainalysis describes the attack as ongoing and multifront, and has not said where the infrastructure compromise occurred or whether the intercepted data was TLS encrypted. The company's statements also differ in tone: it first called the accessed customer data non-sensitive, a label Ars Technica says it cannot explain, and later acknowledged exposed customer passwords.
“non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform were accessed.”
— Chainalysis, in an email to affected customers