Chainalysis confirms hackers stole password hashes and live tokens in October breach
BREACHChainalysisredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Chainalysis disclosed on 30 October that an external actor using what it described as offensive agentic techniques gained unauthorised access to internal systems and tools. The company now confirms exposure of usernames, password hashes and live tokens, and later described the activity as an ongoing multifront attack and an on-path (AitM) attack. The hashing algorithm has not been disclosed, so offline crackability cannot be assessed. Defenders should expect password resets and API key rotation, and should ensure reused credentials are changed on other sites. No CVE identifiers were given.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Change your password on any other site where you reuse the same credentials.
- Chainalysis customers should give support or their account manager trusted IP addresses for the allowlist before resetting passwords.
- Expect to reset your Chainalysis password and rotate any API keys as the company requires.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
The Register (Security)
Who and what is in it
Companies