Chainalysis, the blockchain analysis firm used by law enforcement agencies and major banks, says hackers obtained names, usernames, password hashes and live access tokens for all of its users. The company says the attackers used AI agent-assisted techniques.
If you work with the company’s tools, or your employer does, the practical takeaway is simple: expect a mandatory credential reset.
What Chainalysis Has Said
According to reporting by Ars Technica, the company first told customers that it had been hit by a cybersecurity incident in October. It said an outside actor used “AI agent-assisted offensive techniques” to reach its systems and internal tools. The first notice described the exposed data as “non-sensitive”: user IDs, full names, email addresses and role labels.
A Wednesday update went further. Chainalysis said an “on-path attack,” in which an attacker sits on infrastructure that carries traffic between two parties, exposed a subset of customer passwords. It said the attack vector had been identified and fixed. Later that day it said an investigation had found that names, usernames, password hashes and live tokens for all users were exposed.
The company took its login page and its transaction-monitoring service offline, and pulled access to its Reactor and Data Solutions products. On Friday it began phasing customers back onto KYT and Address Screening. It asked customers to send trusted IP addresses for an allow list and to be ready to reset credentials, which it says is mandatory.
Chainalysis says its investigation has so far found no sign that investigation data was accessed or that its attribution data was tampered with.
Why This Matters Beyond Crypto
Chainalysis’s customers reportedly include government agencies such as the FBI, Immigration and Customs Enforcement and the Air Force, along with companies such as Microsoft, Coinbase and Barclays. A list of who uses a tool like this, and who logs in to it, is useful to anyone trying to target those users with phishing.
Password hashes are scrambled versions of passwords, not the passwords themselves. They can still be cracked offline, especially when the originals were weak or reused. A live token is more urgent: it can act as a pass into an account without a password at all until it is revoked.
What Is Still Unknown
Ars Technica notes several open questions. Chainalysis has not said where the infrastructure was compromised or whether the captured traffic was encrypted. It has not explained why it waited until Wednesday to disclose the exposure when its investigation found it on Monday. And it has given no detail on the AI agents used. A company representative declined to comment beyond its blog posts.
We also don’t know whether the stolen data has been used against any customer. Treat any description of the attackers’ methods as the company’s account, not independently confirmed.
What Customers Should Do
- Reset your Chainalysis password as soon as access returns, and make it unique.
- Revoke and reissue any API keys or tokens tied to your account.
- Turn on multifactor authentication if it is available to you.
- Be skeptical of emails that appear to come from Chainalysis, especially ones asking you to click a login link. Go to the company’s site directly.
- If you reused that password anywhere else, change it there too.
The incident also fits a pattern we have covered: attackers using AI agents to find exposed passwords and keys faster. India’s national cyber agency warned of the same thing earlier this fall.
More on Contoh
- India Warns That AI Agents Broke Into Live Company Systems During Tests, Using Exposed Passwords and Keys
- Schwab and JPMorgan Block Outside AI Agents From Logging In to Your Accounts