EN PT-BR
← Voltar ao feed
high financial services law enforcement government

Chainalysis Breach Escalates: Password Hashes and Live Tokens Exposed for All Users

8 fonte(s) · 3 atualização(ões) · 5 repetição(ões) · publicado 31/10/2026 09:01 · coletado há 3 horas

Chainalysis, a U.S. blockchain analytics firm whose customers include crypto exchanges, banks, and law enforcement agencies worldwide, disclosed that an external actor used "offensive agentic techniques" to gain unauthorized access to its internal systems and tools earlier in October 2026. The company initially said the intruder accessed only non-sensitive customer data, including user IDs, full names, email addresses, and organization role labels for users provisioned on its platform, and found no evidence that investigation content (graphs, notes, cases), transaction or query results, cleartext passwords, MFA secrets, or session tokens were accessed (chainalysis.com, via helpnetsecurity.com). That assessment was later revised: in an update published late on Wednesday, November 4, 2026, Chainalysis confirmed that usernames, password hashes, and live authentication tokens for all Chainalysis users had in fact been exposed to the attacker, a significant worsening of the previously disclosed scope (theregister.com; chainalysis.com). The disclosure was published on a Friday at roughly 5:14 PM ET, alongside the full text of the notification email sent to affected customers; Chainalysis is still determining exactly which records were accessed for each organization and will provide a detailed breakdown once that analysis is complete (bleepingcomputer.com). Chainalysis has not disclosed the specific tactics or tooling behind the "offensive agentic techniques," the hashing algorithm used to protect user passwords, or the number of affected customers or organizations, which makes it difficult to assess the offline crackability of the exposed hashes (cybersecuritynews.com; theregister.com). It stated the incident is unrelated to the recent Binance hack, which Chainalysis itself has been investigating and which U.S. authorities attributed to the North Korean group TraderTraitor (helpnetsecurity.com).

Detalhes técnicos

The disclosure frames the intrusion within a broader trend: "We are seeing an industry-wide rise in AI-driven cyber attacks, and we are taking a whole-of-company approach to make sure our security posture meets the evolving environment and our customers' expectations," Chainalysis said. Reporting notes this comes as adversarial use of AI has intensified, citing a separate campaign by a China state-backed group tracked as Vapor Panda, which used an agentic penetration-testing framework called ARTEX to compromise roughly 140 targets in 11 days as part of a broad access operation. Abnormal AI commented that "agentic intrusion chains and prompt injection" are a distinct category of threat because they depend directly on deployed AI systems, as opposed to AI simply accelerating established attack techniques. It remains unclear whether the Chainalysis attackers used an existing agentic offensive framework such as ARTEX — which, according to Microsoft, was also used in the ConnectWise supply chain compromise — or custom-built autonomous AI agents capable of independently identifying, exploiting, and chaining vulnerabilities (bleepingcomputer.com). Chainalysis also said it is using large language models (LLMs) to support a broader review of its platform's security (bleepingcomputer.com). In its November 4 update, Chainalysis referred to the intrusion as an "on-path attack," i.e. an attacker-in-the-middle (AitM) technique, which it said exposed a subset of customer passwords; it stated this attack vector "has been contained and remediated" without elaborating further (theregister.com; chainalysis.com). The same update disclosed that Chainalysis detected "abnormal activity" on its transaction-screening products and, as a result, took the KYT user interface and API, address-screening products, and the login page offline, directly notifying customers whose KYT accounts "appear to have been accessed without authorization" (chainalysis.com). Chainalysis continues to state it has no evidence that Reactor investigation data has been accessed or that attribution data has been manipulated (theregister.com).

Detalhes da correção

No advisory names a specific vulnerability or patch; Chainalysis describes ongoing work to "patch vulnerabilities" and "harden" its systems without technical specifics on the exploited flaw (chainalysis.com).

Remediação

Chainalysis said it is patching vulnerabilities and hardening its systems, has engaged third-party cybersecurity experts to investigate and review platform security, and as of November 3, 2026, proactively took certain products offline — including Reactor and Data Solutions — pending additional security assessments (helpnetsecurity.com). Some users received emails instructing them to reset passwords, but as of November 4 the password-reset function itself was disabled; affected customers were advised instead to change reused passwords on other services (theregister.com). Chainalysis plans to restore KYT and Address Screening on November 5, requiring customers to submit trusted IP addresses to their support team or account manager for an allowlist before password resets are permitted; every user will be required to reset passwords and rotate API keys once Reactor and Data Solutions are restored (theregister.com; chainalysis.com). The company notified affected customers by email, urging them to watch for unexpected password reset requests or authentication prompts, enable two-factor authentication, and remain vigilant against social engineering, including scammers impersonating Chainalysis and offering fund recovery or recruiting services, given the exposure of names and contact details to an actor targeting an organization whose clients include law enforcement and government agencies (bleepingcomputer.com).

Relatos divergentes

Chainalysis's initial October 30 disclosure stated it had "found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens" (chainalysis.com, via helpnetsecurity.com). This was superseded by the company's own November 4 update, which confirmed that password hashes and live tokens for all users had in fact been exposed, directly contradicting the earlier assessment; the more recent, authoritative statement is the company's own November 4 disclosure (chainalysis.com; theregister.com).

Linha do tempo

  1. theregister.com ↗ · pub. 05/11/2026 15:03 · coletado 05/11 16:00

    Chainalysis Confirms Password Hashes, Live Tokens Exposed in Agentic 'On-Path' Breach

    This article adds that Chainalysis's November 4 update significantly worsened the known scope of the breach: password hashes and live authentication tokens for all users were confirmed exposed, contradicting the company's earlier statement that no authentication credentials or session tokens had been accessed. It also details the 'on-path' (AitM) attack vector, the suspension of the password-reset function, the shutdown of KYT, Address Screening, and the login page, and the phased restoration plan requiring IP allowlisting, mandatory password resets, and API key rotation.

    ler a análise desta fonte

    This article adds that Chainalysis's November 4 update significantly worsened the known scope of the breach: password hashes and live authentication tokens for all users were confirmed exposed, contradicting the company's earlier statement that no authentication credentials or session tokens had been accessed. It also details the 'on-path' (AitM) attack vector, the suspension of the password-reset function, the shutdown of KYT, Address Screening, and the login page, and the phased restoration plan requiring IP allowlisting, mandatory password resets, and API key rotation.

    Chainalysis confirmed in a late-Wednesday (November 4) update that attackers who breached its systems in October also obtained usernames, password hashes, and live authentication tokens, expanding significantly on its earlier disclosure that only non-sensitive identity data (user IDs, names, emails, role labels) had been exposed. The company has not disclosed the hashing algorithm used to protect the passwords, making it impossible to assess how easily the hashes could be cracked offline. Chainalysis described the intrusion as an "on-path attack" — also known as attacker-in-the-middle (AitM) — and an "ongoing multifront cyberattack," but has not named the perpetrator, only noting similarities to attacks on "many other tech platforms in recent weeks." The company's Reactor (used by international law-enforcement customers), Data Solutions, and KYT anti-money-laundering products were taken offline after "abnormal activity" was detected on its transaction-screening systems. Chainalysis maintains there is no evidence that investigation data or attribution data has been accessed or manipulated.

    Technical Details

    Chainalysis first disclosed the breach on October 30, stating an external actor used "offensive agentic techniques" to gain unauthorized access to its internal systems. The November 4 update significantly worsened the picture: the company confirmed that password hashes and live tokens for all Chainalysis users were exposed to the malicious actor, and that it had detected abnormal activity prompting it to take the KYT user interface and API, address-screening products, and the login page offline, directly notifying customers whose KYT accounts "appear to have been accessed without authorization" (chainalysis.com). The password-reset function itself has been disabled while the company hardens its systems, though users have been urged to change reused passwords on other services in the meantime.

    Remediation

    Chainalysis plans to restore KYT and Address Screening on November 5, requiring customers to submit trusted IP addresses to their support team or account manager for an allowlist before resetting passwords. Every user will be required to reset passwords and rotate API keys as part of hardened account-access protections once Reactor and Data Solutions are restored. The company says it is working around the clock with outside security experts to harden its systems and bring the affected products back online securely.

  2. bleepingcomputer.com ↗ · pub. 31/10/2026 09:50 · coletado 31/10 10:00

    Chainalysis Discloses Breach After Attackers Use "Offensive Agentic Techniques" Against Internal Systems

    This article adds detail on the timing and handling of the disclosure: Chainalysis published the incident notice on a Friday at roughly 5:14 PM ET, said the unauthorized access occurred "earlier this month," and is using large language models to support a broader security review while still determining which records were accessed per affected organization. It also clarifies that the agentic offensive framework ARTEX — one possible tool used in the intrusion, though unconfirmed — was separately linked by Microsoft to the ConnectWise supply chain compromise. The piece situates the Chainalysis breach within a broader wave of crypto/tech security incidents that same week, including Binance's attribution of its roughly $6.3 billion theft (the largest crypto heist on record) to North Korean state-backed hackers via a compromised DevOps engineer's laptop, a suspected hardware implant found in a Trezor Safe 5 device, and a malicious Cursor-marketplace version of Anthropic's Claude Code extension that planted SSH backdoors on developer machines — none of which are part of the Chainalysis incident itself.

    ler a análise desta fonte

    This article adds detail on the timing and handling of the disclosure: Chainalysis published the incident notice on a Friday at roughly 5:14 PM ET, said the unauthorized access occurred "earlier this month," and is using large language models to support a broader security review while still determining which records were accessed per affected organization. It also clarifies that the agentic offensive framework ARTEX — one possible tool used in the intrusion, though unconfirmed — was separately linked by Microsoft to the ConnectWise supply chain compromise. The piece situates the Chainalysis breach within a broader wave of crypto/tech security incidents that same week, including Binance's attribution of its roughly $6.3 billion theft (the largest crypto heist on record) to North Korean state-backed hackers via a compromised DevOps engineer's laptop, a suspected hardware implant found in a Trezor Safe 5 device, and a malicious Cursor-marketplace version of Anthropic's Claude Code extension that planted SSH backdoors on developer machines — none of which are part of the Chainalysis incident itself.

    Blockchain analytics firm Chainalysis disclosed a security incident in which an external actor used so-called "offensive agentic techniques" to gain unauthorized access to internal systems and tools earlier this month. The company says accessed customer data was limited to user IDs, full names, email addresses, and organizational role labels, with no evidence that investigation data, authentication credentials, or session tokens were exposed. Chainalysis is still determining which records were accessed per organization and is using large language models (LLMs) to support a broader security review of its platform, while working with external cybersecurity experts. The company stated the incident is unrelated to the recent Binance theft.

    Technical Details

    Chainalysis has not disclosed which vulnerabilities were exploited, which internal tools were accessed, or the duration of attacker access. It remains unclear whether the attackers relied on an existing agentic offensive security framework such as ARTEX — which, according to Microsoft, was also used in the ConnectWise supply chain compromise — or on custom-built autonomous AI agents capable of identifying and chaining exploits on their own.

    Remediation

    Chainalysis advised affected customers to enable two-factor authentication (2FA) and watch for unexpected password reset requests, authentication prompts, and scammers impersonating the company, particularly those offering fund recovery or recruiting services. The company says it is patching vulnerabilities, hardening its systems, and will share further updates as its investigation progresses.

  3. thehackernews.com ↗ · pub. 31/10/2026 09:01 · coletado 31/10 10:00 primeiro registro

    Chainalysis Confirms AI-Driven Intrusion Exposing Customer Identity Data

    ler a análise desta fonte

    Chainalysis, a U.S. blockchain analytics firm whose customers include crypto exchanges, banks, and law enforcement agencies worldwide, disclosed that an external actor used "offensive agentic techniques" to gain unauthorized access to its internal systems and tools in October 2026. The company said the intruder accessed non-sensitive customer data, including user IDs, full names, email addresses, and organization role labels for users provisioned on its platform, but found no evidence that investigation content (graphs, notes, cases), transaction or query results, cleartext passwords, MFA secrets, or session tokens were accessed (chainalysis.com, via helpnetsecurity.com). Chainalysis has not disclosed the specific tactics or tooling behind the "offensive agentic techniques," and has not published the number of affected customers or organizations (cybersecuritynews.com). The company stated the incident is unrelated to the recent Binance hack, which Chainalysis itself has been investigating and which U.S. authorities attributed to the North Korean group TraderTraitor (helpnetsecurity.com).

    Technical Details

    The disclosure frames the intrusion within a broader trend: "We are seeing an industry-wide rise in AI-driven cyber attacks, and we are taking a whole-of-company approach to make sure our security posture meets the evolving environment and our customers' expectations," Chainalysis said. The article notes this comes as adversarial use of AI has intensified, citing a separate campaign by a China state-backed group tracked as Vapor Panda, which used an agentic penetration-testing framework called ARTEX to compromise roughly 140 targets in 11 days as part of a broad access operation. Abnormal AI commented that "agentic intrusion chains and prompt injection" are a distinct category of threat because they depend directly on deployed AI systems, as opposed to AI simply accelerating established attack techniques.

    Remediation

    Chainalysis said it is patching vulnerabilities and hardening its systems, has engaged third-party cybersecurity experts to investigate and review platform security, and as of November 3, 2026, proactively took certain products offline — including Reactor and Data Solutions — pending additional security assessments (helpnetsecurity.com). The company notified affected customers by email, urging them to watch for unexpected password reset requests or authentication prompts, enable two-factor authentication, and remain vigilant against social engineering given the exposure of names and contact details to an actor targeting an organization whose clients include law enforcement and government agencies.

Repetiram sem novidade