Chainalysis says breach exposed password hashes and live tokens

Chainalysis disclosed that a cyberattack exposed more information than it first reported. An update said a malicious actor obtained customer names, usernames, password hashes and live tokens. The company has not clarified whether every affected user had all of these data types exposed. The disclosure followed an Oct. 30 statement that the intruder had accessed user IDs, names and email addresses, with no evidence then of access to credentials or session tokens.

A later update described an “on-path attack” that exposed some customers’ passwords. Chainalysis said it contained and fixed that route of attack, was locking affected accounts and requiring password resets. The expanded disclosure raises the potential risk to users because password hashes and live tokens can be security-sensitive, although the company did not provide further details about the scope or use of the exposed information. It said it still had no evidence that the attacker accessed investigation data or altered its attribution data, which the firm uses in its blockchain analytics work.