Chainalysis makes its living by watching. It follows money from wallet to wallet across the blockchain and turns the movement of stolen coins into maps that investigators can use. The people who buy those maps do a great deal of watching themselves. According to the company and to public records, its clients include the FBI, US Immigration and Customs Enforcement and the US Air Force, along with Microsoft, Coinbase and Barclays, as Dan Goodin reported for Ars Technica.
Now the company says someone has been watching it. Hackers who got inside its network came away with names, usernames, password hashes and live tokens. Chainalysis says this covers all of its users, not some of them.
Friday: the word “non-sensitive”
The first notice came on Friday, October 30. Chainalysis said it had suffered a cybersecurity incident in October that resembled hacks of other platforms that same month. In its account, an outside actor used offensive techniques assisted by AI agents to reach its systems and internal tools. The email to affected customers was calm. It said some “non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform were accessed.” That first notice also said the company had found no sign of access to authentication credentials or session tokens, Cointelegraph reported.
Think about what that list contains. These are the full names, email addresses and job roles of people who use a blockchain-forensics platform, many of them inside agencies whose work is pursuing criminals. Chainalysis did not explain why it called this non-sensitive. Bureaucracies have their own vocabulary, and in that vocabulary the first word an institution uses about its own wound is usually the gentlest one it can find.
Monday, then Wednesday
The gentle word did not hold. The company later stated that on Monday, November 2, it “discovered certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor.” That same day, according to Bitcoin.com News and other trade press, Chainalysis took its Reactor investigations tool and its Data Solutions offline for further review.
The Wednesday update added a second problem. The company said the “ongoing multifront cyberattack” had included an “on-path attack” that exposed a subset of customer passwords, and that it had found and closed that route. An on-path attack, also called an adversary-in-the-middle attack, means the intruder has taken control of some piece of infrastructure that carries traffic between two parties. Chainalysis has not said where that compromise happened, or whether the data that passed through it was protected by TLS encryption.
The difference matters. A password hash is a scrambled version of a password, and an attacker has to work to recover the original from it. A password captured in transit may be the original itself. A live token is a credential that is still valid. Chainalysis has also not said whether the intercepted passwords and the exposed tokens came from the same attack method.
The damage spread through the company’s products. Trade reports say that on Wednesday its KYT transaction-monitoring interface and API, its address-screening products and even its login page were suspended after abnormal activity. Access to KYT and Address Screening was then due to resume on November 5, but only for customer IP addresses on an approved list. A timeline published on DEV Community summed up the arc: from “No Credentials Accessed” to “All Users Exposed” in five days. It also describes customers being told to reset their passwords and then reportedly learning that a reset was not currently possible. They were advised instead to change any reused passwords on other services.
What has not been said
Some things remain unknown. Chainalysis has not named the attacker. It has not said how many accounts were improperly accessed, how the on-path attack worked or how long it ran. It says it is locking affected accounts and requiring password resets. It says it has no evidence that investigation data was accessed or that its attribution data was manipulated. For a company whose product is the claim that a given wallet belongs to a given actor, that second assurance carries the most weight. Whether the theft has exposed customers to further threats is not yet clear.
Customers who want to return now have to send Chainalysis their trusted IP addresses for approval, according to trade reports. Once admitted, they must reset their passwords and, where needed, rotate their API keys before they can register transactions again. The company has also urged them to watch for suspicious messages and unexpected authentication requests, to turn on two-factor authentication, and not to click links in unexpected password-reset emails.
The watcher, watched
A month ago Chainalysis described how North Korea took $387 million from Bitget and how its own AI followed every transfer. The tools that make that kind of tracking possible are the same kind of tools the company now says were used to break into it, in a season when AI models have been seen breaching systems on their own. A reflection, not a finding: institutions that sell visibility tend to assume they cannot be seen themselves.
For now, the company that tracks thieves through the ledger is screening its own customers by IP address, including agents of the FBI and ICE, and letting them back in one approved address at a time.