Blockchain analytics firm Chainalysis has widened its account of a breach, saying the attacker obtained names, usernames, password hashes and live tokens belonging to all of its users, as reported by Cointelegraph. The company says a separate on-path attack also exposed passwords for some customers.
The disclosure marks a sharp change from the company’s first notice on October 30, which said user IDs, names and email addresses were exposed and that it had found no evidence attackers reached authentication credentials or session tokens. Chainalysis says it learned of the more sensitive exposure days later and then updated its public notice.
The company says it has contained and fixed the on-path attack route, is locking affected accounts and is requiring password resets. As far as it knows, its investigation and attribution data was not accessed or manipulated. Unchained reports that Chainalysis has begun reopening compliance tools behind IP allowlists, in what it counted as the sixth breach update.
Cointelegraph notes that it is unclear whether live tokens have been revoked, and Chainalysis declined to share more beyond its published notice. Customers should follow the instructions in that notice, and anyone who reused a Chainalysis password elsewhere should change it there too. The reporting does not name an attacker or say how many accounts were affected beyond the company’s statement that it covers all users.