Chainalysis says October multifront breach with AI-assisted and on-path phases exposed all-user credentials and tokens
Chainalysis, the blockchain analysis firm, said hackers obtained names, usernames, password hashes and live tokens for every user after an October breach of its network. It described a “multifront cyberattack” that combined AI agent–assisted methods to reach systems and internal tools with an on-path, or adversary-in-the-middle, phase that exposed a subset of customer passwords; that vector has been identified and fixed, though the company has not said where the infrastructure was compromised or whether the captured traffic was TLS-encrypted.
An email to affected customers said some “non-sensitive” data was accessed: user IDs, full names, email addresses and organisation-role labels for users provisioned on the platform. Ars Technica notes it is unclear why Chainalysis treated that as non-sensitive. Public sources and the company itself have tied high-profile clients to the firm, including the FBI, US Immigration and Customs Enforcement, the US Air Force, Microsoft, Coinbase and Barclays; whether the theft creates extra risk for them remains unsettled.
A Monday investigation found the all-user credential and token exposure; the company disclosed that on Wednesday and has not explained the two-day lag. After detecting abnormal activity it took down its login page and know-your-transaction (KYT) service, which watches cryptocurrency threats in real time, and cut access to Reactor and Data Solutions. By Friday it was phasing KYT and Address Screening back in, asking customers for trusted IP addresses for an allow list and requiring a credential reset. It says it has found no sign that investigation data was accessed or attribution data manipulated, has given no detail on the AI agents, and a representative said it would not comment beyond its blog post.
Continue in the app — vote & join in ➔