Chainalysis breach exposes every user's credentials
The blockchain forensics firm says an agentic cyber attack exposed names, usernames, password hashes and live tokens across its entire user base, and it has cut off access to Reactor and Data Solutions. It says it has no evidence investigations data was accessed.
Chainalysis has disclosed that its investigation into an ongoing cyber attack found names, usernames, password hashes and live tokens exposed for all of its users. The blockchain analysis firm said it removed access to Reactor and Data Solutions while it looked into the incident. It also said it continues to have no evidence that any investigations data has been accessed.
The firm that sells attribution cannot attribute this
Chainalysis sells visibility. Its customers are exchanges, banks and law enforcement agencies who pay to follow money across blockchains, and the product depends on the firm being able to see further than its clients can. The disclosure describes an "agentic" attack and nothing else: no attribution, no entry point, no timeline. That gap matters more than usual when the victim's business is telling other people who did what.
The exposed material is not uniform in severity. Password hashes can be cracked or, more often, reused elsewhere; a live token needs neither, because it is already the proof of a logged-in session. Credential sets that include tokens are the kind that survive a password reset and, depending on how sessions were issued, can sidestep the second factor entirely.
Customers of Reactor and Data Solutions are now locked out of tools they rely on for compliance and tracing work, with no stated date for restoration. The notice covers users, not systems, which suggests the company is treating account access itself as the exposure surface. Anyone holding a session on a Chainalysis product has to assume the token, not just the password, is in someone else's hands.