Chainalysis said an investigation launched Monday found that malicious actors had exposed sensitive information belonging to all of its users, including names, usernames, password hashes and live tokens. The company detected “anomalous activity” and shut down its login page, transaction confirmation service, Reactor and Data Solutions services while it investigated the incident.
Services gradually restored
In an update on Friday, Chainalysis said it was gradually restoring customer access to its Know Your Transaction (KYT) and address-screening services, with more customers expected to follow.
The company asked customers to submit trusted IP addresses so they could be added to an allowlist. It also told customers to prepare to reset their credentials once access was restored, saying that credential rotation would be mandatory.
Chainalysis said its investigation had not uncovered evidence that research data was accessed or that its attribution data was manipulated.
Questions about the attack remain
Several important questions remain unanswered. The source that enabled the on-path attack is still unknown, and it is unclear how useful the information obtained would be unless the attacker could decrypt the traffic being monitored. If the attacker had that capability, it could have gained extensive control over the company’s infrastructure.
Chainalysis also did not explain why it waited until Wednesday to disclose that an investigation had identified the exposure of its customers’ personal information two days earlier. The company provided no details about the AI agent reportedly used in the attack or how it operated.
A Chainalysis representative said the company had no comment beyond the statement in its blog post.
Source: arstechnica.com
