A cyberattack on Chainalysis has turned into a much more serious security incident than the company initially acknowledged. The blockchain analytics provider has confirmed that attackers exposed some customer passwords and accessed personal account information, forcing the company to suspend several services while it works to secure its systems.
The first warning came on October 30, when Chainalysis disclosed an attack it described as similar to incidents affecting other technology companies in recent weeks. It stressed that the incident was unrelated to the recent cryptocurrency theft involving Binance. Its initial investigation found no evidence that passwords, authentication credentials, session tokens, or investigation data had been accessed. However, attackers had obtained user IDs, names, email addresses, and organizational roles.
That assessment changed on November 4. In an email to affected customers, Chainalysis confirmed that an “on-path attack” had exposed a subset of passwords. The company said it had contained the attack and required affected users to reset their credentials. It also advised customers to rotate API keys where necessary.
The response disrupted access to several products, including Reactor, Data Solutions, Chain (Beta), KYT, and Address Screening. Chainalysis has since begun restoring KYT and Address Screening, although access is returning gradually as the company monitors its systems. Customers can submit trusted IP addresses by email if they want to regain access sooner.
The incident is particularly concerning because Chainalysis provides blockchain intelligence tools used by governments, law enforcement agencies, and businesses to trace cryptocurrency transactions and investigate financial crime.
There is still no clear indication of who carried out the attack or whether the incident will lead to an extortion attempt. No group has claimed responsibility, and the stolen information has not publicly appeared on dark web marketplaces or forums. Chainalysis has not disclosed any contact with the attackers.