The company said later that day that an investigation two days earlier (on Monday) had revealed that “certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor.” It also said it had detected “abnormal activity” and, in response, took down its login page and know-your-transaction service, which monitors threats to cryptocurrency holdings in real time. The company has also removed access to its Reactor and Data Solutions services.
In an update on Friday, Chainalysis said it had begun phasing in customer access to KYT and Address Screening and expected more customers to follow. It asked customers to submit their trusted IP addresses so they can be added to an allow list and to prepare to reset credentials once they regain access. The credential rotation is mandatory.
The company says its investigation has yet to reveal any evidence that any investigation data has been accessed or Chainalysis attribution data has been manipulated.
Several important questions remain unanswered. As noted, the source that made the on-path attack possible is still unknown. It’s not clear how useful the information obtained in such an attack would be unless the attackers also had the ability to decrypt the traffic they were monitoring. If that were the case, the attackers might have gained broad control of the company’s infrastructure.
Chainalysis also didn’t explain why it waited until Wednesday to disclose the data theft of all customers’ personal information when its investigation discovered the exposure two days earlier. Further, the company has provided no details about the AI agents used in the attack and how they worked.
A Chainalysis representative said the company wasn’t commenting beyond the statements in its blog post.
