Chainalysis: Names, Usernames, Password Hashes, and Valid Tokens of All Users Were Exposed; Some Plaintext Passwords Also Leaked

Blockchain analytics firm Chainalysis disclosed in an updated security incident notice that the names, usernames, password hashes, and valid authentication tokens of all users had been exposed to the attacker, and that some customers’ plaintext passwords were also leaked through a separate attack method. After detecting abnormal activity, the company suspended KYT transaction monitoring, address screening, and login services, and required all users to reset their passwords and rotate API keys where necessary.

Previously, on October 30, Chainalysis first disclosed that it had been breached by a hacker using offensive AI agent technology; at that time it only confirmed that certain customer identity information had been accessed and said it had found no evidence that passwords or session tokens had been leaked.