Chainalysis Breach Worsens: Password Hashes and Live Tokens Stolen, Law Enforcement Tools Taken Offline
Chainalysis, a blockchain analysis firm widely used by law enforcement and financial institutions, confirmed that an October intrusion resulted in the theft of usernames, password hashes, and live authentication tokens, in addition to previously disclosed user IDs, names, emails, and organizational roles. The company detected the breach on October 30, 2026 and described it as an "ongoing multifront cyberattack" involving an "on-path attack" (AitM), attributing initial access to an external actor using offensive agentic techniques. Services including Reactor (used by international law enforcement), Data Solutions, and KYT have been taken offline while Chainalysis hardens its systems; password reset functionality is also currently down. Chainalysis states there is no evidence investigation data was accessed or attribution data manipulated, though the disclosure reflects a worsening impact assessment over time.
Detalhes técnicos
The attacker reportedly used an AI agent and "offensive agentic techniques" to gain unauthorized access, which Chainalysis has compared to attacks affecting other tech platforms in recent weeks. The company referred to the intrusion as an "on-path attack," i.e., an attacker-in-the-middle (AitM) technique, without further technical elaboration. No hashing algorithm was disclosed for the compromised password hashes, limiting assessment of offline crackability risk.
Remediação
Chainalysis is requiring all users to reset passwords and rotate API keys once services are restored. Customers must submit trusted IP addresses to support or their account manager to be allowlisted before regaining access. KYT and Address Screening were expected to be reinstated November 5; Reactor and Data Solutions remain down as the company works with outside experts to harden its systems. Users are urged to change reused passwords across other sites given the password reset tool is currently unavailable.
Linha do tempo
-
Chainalysis Breach Worsens: Password Hashes and Live Tokens Stolen, Law Enforcement Tools Taken Offline
ler a análise desta fonte ocultar
Chainalysis, a blockchain analysis firm widely used by law enforcement and financial institutions, confirmed that an October intrusion resulted in the theft of usernames, password hashes, and live authentication tokens, in addition to previously disclosed user IDs, names, emails, and organizational roles. The company detected the breach on October 30, 2026 and described it as an "ongoing multifront cyberattack" involving an "on-path attack" (AitM), attributing initial access to an external actor using offensive agentic techniques. Services including Reactor (used by international law enforcement), Data Solutions, and KYT have been taken offline while Chainalysis hardens its systems; password reset functionality is also currently down. Chainalysis states there is no evidence investigation data was accessed or attribution data manipulated, though the disclosure reflects a worsening impact assessment over time.
Technical Details
The attacker reportedly used an AI agent and "offensive agentic techniques" to gain unauthorized access, which Chainalysis has compared to attacks affecting other tech platforms in recent weeks. The company referred to the intrusion as an "on-path attack," i.e., an attacker-in-the-middle (AitM) technique, without further technical elaboration. No hashing algorithm was disclosed for the compromised password hashes, limiting assessment of offline crackability risk.
Remediation
Chainalysis is requiring all users to reset passwords and rotate API keys once services are restored. Customers must submit trusted IP addresses to support or their account manager to be allowlisted before regaining access. KYT and Address Screening were expected to be reinstated November 5; Reactor and Data Solutions remain down as the company works with outside experts to harden its systems. Users are urged to change reused passwords across other sites given the password reset tool is currently unavailable.