The company the crypto world hires to catch criminals got caught by one. Chainalysis disclosed on Friday that an attack exposed names, usernames, password hashes, and live tokens for all of its users, according to The Hacker News. A live token lets an attacker act as a signed-in user without ever knowing the password.
That is a long way from the first version. On October 30, Chainalysis said an external actor had used "offensive agentic techniques" to get inside, but insisted only non-sensitive data had been reached — no passwords, no session tokens. By November 2 it had taken Reactor and Data Solutions offline as a precaution. On November 4, an "on-path attack" was found to have exposed a subset of customer passwords, and abnormal activity forced its Know Your Transaction service, address screening, and login page offline too. Late that Wednesday, the company said the exposure covered every user.
The reversal matters because of who uses Chainalysis. Exchanges, banks, and law enforcement use its tools to trace stolen funds and screen transactions for money laundering. With Reactor dark a week in, investigators tracing the recent Binance theft have lost their best map. Chainalysis says it still has no evidence that investigation data was accessed or that its attribution data — the links between blockchain addresses and real-world entities — was manipulated, and stresses the incident is unrelated to the Binance theft. That is the line to watch: if attribution data is clean, the damage is credential exposure and downtime; if not, it is trust in the map itself.
Chainalysis notes it resembled incidents at "many other tech platforms in recent weeks." The pattern is now familiar: an autonomous agent — here, a framework called ARTEX — scans public GitHub repositories for exposed secrets, then pivots through cloud services with no human at the keyboard. Microsoft, which has tracked the campaign since August, said in at least one case an agent went from scanning GitHub to exfiltrating data from an Azure Key Vault in five minutes. Google reported this week that criminals resell stolen LLM access.
Chainalysis began restoring KYT and Address Screening in phases Friday morning, but every user must reset passwords and rotate API keys, and organizations must submit trusted IPs for an allowlist first. Reactor and Data Solutions have no return date. The company that sells the world a way to follow the money now has to rebuild its own front door.
— via The Hacker News