Chainalysis Says Breach Exposed Password Hashes, Live Tokens

Chainalysis disclosed the broader impact of a cyberattack on Wednesday, Nov. 4, after initially describing the incident as limited to non-sensitive customer information. The blockchain analytics firm identified names, usernames, password hashes and live tokens among the exposed data.

The company said it discovered the additional account details on Monday. It did not specify whether each affected user had every type of information exposed and declined to provide further details beyond its public statements.

In a separate update, Chainalysis reported that an “on-path attack” had exposed some customers’ passwords. The company said it had contained and fixed the attack method, locked affected accounts and required users to reset their passwords.

Chainalysis first reported the intrusion on Oct. 30, saying attackers had accessed user IDs, names and email addresses. At the time, the company found no evidence that authentication credentials or session tokens had been exposed.

The blockchain analytics firm said it still had no evidence that attackers accessed investigation data or changed attribution data.

Reviewed and fact-checked by Alex Panasenko on November 6.