Chainalysis says breach exposed credentials for all users

Chainalysis has disclosed that an attack on its systems exposed names, usernames, password hashes and live tokens for all of its users. The company described the incident as an "agentic cyber attack" and said the exposure came to light during its investigation.

In a statement quoted by The Hacker News, the firm said: "While we investigated, we removed access to Reactor and Data Solutions." It added that it continues to have "no evidence that any investigations data has been accessed."

That last point is the one to read carefully. Credentials for every account is a serious disclosure on its own, but the claim about investigation data is a statement about what the company has found so far, not a finding that nothing was taken. The report doesn't say how the attacker got in, when the access began, or whether the tokens were revoked rather than just cut off by shutting the products down.

For anyone with a Chainalysis account, the practical items are the live tokens and the password hashes. Rotate API tokens and any credentials tied to Reactor or Data Solutions, and change the account password. Hashes are only as good as the hashing scheme, and the report doesn't say which one was used.

We'd treat the silence on how the intrusion happened as the open question here. Until Chainalysis publishes more, the scope of what the attacker could reach inside the environment is unknown.