Chainalysis is requiring a password reset across its user base after a security incident exposed account credentials and led the firm to suspend three services.
The breach reached the full user base, Chainalysis said, exposing account identifiers and authentication data, including hashed passwords and active authentication tokens. It requires all users to change passwords; API key changes may be necessary in some cases.
Some customers’ plaintext passwords were compromised through a separate method, Chainalysis said. In its Oct. 30 notice, the company acknowledged that some customer identity details had been accessed, while reporting no indication at that point of password or session-token exposure.
The detected activity led the firm to suspend its transaction-monitoring, address-screening and login services. In an earlier response, Chainalysis said it had engaged outside cybersecurity specialists to review platform defenses and advised users to watch for unexpected password-reset requests and authentication prompts, and to enable two-factor authentication if they had not already.
The new disclosure adds credential details to Chainalysis’ earlier account of an intruder using AI-agent techniques.
