October crypto-tracker hack: Access cracked, law enforcement tokens packed

Agentic 'on-path attack' went after Chainalysis's tools, which are routinely called upon to assist police investigations

Blockchain analysis outfit Chainalysis has confirmed that when attackers broke into its systems in October, they managed to grab usernames, password hashes, and live tokens.

In an update written late Wednesday evening, the company, a leader in blockchain analysis which has some very high-profile global customers and partners, confirmed the impact of the attack for the first time.

In previous updates, which Chainalysis has issued regularly since it detected the intrusion on October 30, it confirmed that user IDs, full names, email addresses, and organizational role labels were exposed. The news of password hashes and live tokens also being accessed reflects a worsening picture for the company.

REG AD

Chainalysis did not confirm the type of hashing algorithm it used to encrypt users' passwords, which makes it difficult to draw conclusions about the offline crackability of users' hashed credentials.

REG AD

Some users received emails instructing them to change their passwords, but Chainalysis said in its latest update that the password reset functionality is currently down. Nevertheless, users were also encouraged to change their passwords on any site where they reuse credentials.

In addition to the exposed data, Chainalysis also detected "abnormal activity" on its transaction screening products, and has taken services down while "our team completes critical work."

These include, but are not limited to, the Reactor blockchain investigation platform used by international law enforcement customers, the Data Solutions threat intelligence platform, and the KYT (know your transaction) anti-money laundering solution's user interface and login page.

Regarding Reactor and the associated investigation data, Chainalysis said: "At this time, we continue to have no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated."

The company plans to reinstate KYT and the risk-intelligence Address Screening tool at some point today (Thursday November 5). 

Customers will have to provide the company’s support team or their account manager with trusted IP addresses, which will be added to an allowlist. From there, users can begin resetting their passwords.

"We are working around the clock to harden our systems and bring Reactor and Data Solutions back online," Chainalysis said. "We will require additional protections to access accounts, including that every user will have to reset passwords and rotate API keys as appropriate. We will communicate these changes as necessary.

"We know how business-critical these services are to our customers, and we are working expeditiously alongside our outside experts to restore them securely."

REG AD

Chainalysis has not yet commented on who was behind the attack, but implied that the culprits used an AI agent, and likened the attack to others that have hit "many other tech platforms in recent weeks."

"This month, Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools," it told customers in its initial disclosure on October 30. 

"Our teams have been working around the clock to investigate unauthorized activity, patch vulnerabilities, and harden our systems."

In Wednesday's updates, it referred to the intrusion as an "ongoing multifront cyberattack," and later, an "on-path attack," otherwise known as an attacker-in-the-middle (AitM) attack, without elaborating further about what it entailed.

Per its own company description, Chainalysis counts government agencies, cryptocurrency exchanges, financial institutions, and cybersecurity companies among its customer base.

It is one of the world's foremost blockchain analysis companies and is routinely engaged to assist in cyber-related law enforcement investigations.

Recent cases the company was asked to support include the takedowns of crypto-laundering network AudiA6 and bulletproof hosting provider Virtualine, both of which were known facilitators of ransomware crews.

It also played a role in bringing down the infamous LockBit ransomware operation, among other engagements in the interim. ®