Chainalysis man-in-the-middle attack exposes all customer credentials and live tokens
TL;DR
Chainalysis reports that a Man-in-the-Middle attack exposed usernames, password hashes, and live tokens for all customers. The company has taken its core investigative products offline. Users must provide trusted IP addresses to the company to regain access and reset credentials.
What happened
Chainalysis is responding to a breach involving an on-path (Man-in-the-Middle) attack that compromised credentials and live tokens for its entire user base. This follows an earlier disclosure where attackers used AI tools and offensive agentic techniques to access non-sensitive identity metadata, such as names and email addresses.
Following the discovery of the more severe credential exposure, the company has taken several core services offline, including the login portal, Reactor, Data Solutions, the Know-Your-Transaction (KYT) user interface and API, and its address screening products. While the company found no evidence that its investigative graph data or blockchain attribution repositories were accessed or manipulated, it is currently hardening systems to bring services back online.
Why it matters
The breach hits the very heart of blockchain intelligence. Because the attackers obtained live tokens and password hashes, the risk of account takeover is high. The shutdown of the KYT API and Reactor tools creates a significant operational gap for law enforcement, government agencies, and financial institutions that rely on these products to monitor and investigate cryptocurrency transactions. The necessity of an IP allowlist to regain access suggests the company is moving to a highly restrictive access model to prevent further unauthorized activity.
Who is affected
- All Chainalysis users, including law enforcement, government agencies, and financial institutions.
- Chainalysis Reactor
- Chainalysis Data Solutions
- Know-Your-Transaction (KYT) user interface and API
- Address screening products
What to do now
- Contact
[email protected]or your dedicated account team to provide trusted IP addresses for the company allowlist. - Once access to the login portal is granted via your trusted IP, reset your password immediately.
- Rotate all API keys used to register transactions.
- Monitor all accounts and transaction activity for unauthorized changes.
What we don't know yet
- The specific identity or group behind the malicious actor.
- The full extent of the "abnormal activity" discovered after the initial disclosure.
- Whether the attackers successfully utilized the stolen live tokens to perform actions.
Sources
