Chainalysis: Breach leaked password hashes and active token data

Blockchain analytics firm Chainalysis says the fallout from a cybersecurity incident it disclosed last week is broader than first reported. In an updated notice published on Wednesday, the company stated that a malicious actor exposed customer information for all Chainalysis users, including names, usernames, password hashes, and live tokens.

Chainalysis previously said the intrusion involved only non-sensitive customer data and that it had found no evidence attackers accessed authentication credentials or session tokens. The newer account changes the risk picture for users and underscores how incident assessments can evolve as forensic work progresses.

Key takeaways

• Chainalysis now says live tokens, alongside names, usernames, and password hashes, were exposed for all users.
• The company previously reported a narrower scope and said it had not found evidence of compromised authentication credentials or session tokens.
• Chainalysis’ Wednesday update also claims an “on-path attack” led to exposure of some customers’ passwords.
• Despite the expanded data exposure, Chainalysis says it has no evidence attackers accessed investigation data or manipulated its attribution data.
• The firm says it is locking affected accounts and requiring password resets to reduce further account risk.

Updated incident scope: from limited data to live tokens

In its Wednesday update, Chainalysis said that on Monday it identified “certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users” as exposed to a malicious actor. The company did not clarify in its update whether every listed data type was exposed for every user, and it declined to provide additional details beyond its published disclosure.

The inclusion of live tokens materially raises potential impact. Even without immediate confirmation of account takeover, exposure of session-related artifacts can increase the chance of unauthorized access attempts—particularly if tokens remain valid and usable for a window of time. For users, this shift also suggests that relying solely on the initial “non-sensitive” framing may no longer be appropriate.

What Chainalysis originally reported on Oct. 30

Chainalysis’ earlier disclosure, dated Oct. 30, described the intrusion as targeting user IDs, names, and email addresses. At that time, the company said it found no evidence that attackers accessed authentication credentials or session tokens.

The Wednesday update does not contradict every element of the earlier report—rather, it expands what Chainalysis now believes was exposed and adds a further dimension through an “on-path” mechanism. The practical takeaway for readers is that initial incident notices can change as investigators determine what data was actually accessible and how the attacker interacted with systems.

That progression is particularly important in cybersecurity communications: early announcements often aim to establish baseline facts and immediate remediation steps, while later updates may refine technical scope once forensic evidence is fully analyzed.

Passwords exposed via an “on-path attack”

Alongside the broader exposure claim, Chainalysis said another aspect of the incident involved an “on-path attack” that exposed some customers’ passwords. According to the update, the company contained and remediated this vector.

Chainalysis also said it is locking affected accounts and requiring password resets for users impacted by the exposed-password portion of the event. That step is consistent with the nature of password exposure: even if the exposure is limited to some customers, rotating credentials is typically necessary to ensure any stolen passwords can’t be reused elsewhere.

While the company did not specify how many users fell into the “some customers” category, the fact that passwords were reportedly involved—directly through an on-path attack—means affected users should treat password reset as urgent rather than optional.

No evidence of compromise to investigation and attribution data

Even with the expanded scope of customer data exposure, Chainalysis said it still has no evidence that attackers accessed investigation data or manipulated its attribution data. For an analytics provider that supports compliance, tracing, and investigative workflows, this distinction matters: customer information exposure raises account-security and privacy concerns, but access to investigation or attribution systems would imply a higher level of operational disruption and potential integrity risk.

Chainalysis did not provide further technical detail in its update, nor did it offer additional incident-response specifics beyond what was already disclosed. However, by drawing a line between customer-data exposure and core investigative datasets, the company is signaling that—based on its current findings—the attacker’s access did not extend to the outputs and internal processes that clients rely on.

For users evaluating vendor risk, this separation is a critical nuance. It helps frame what to worry about most immediately (account and credential security) versus what remains a longer-term question (the potential for system integrity issues, if evidence later emerges).

What users and teams should watch next

As Chainalysis continues to assess the incident, the most important open questions are how widely each data element was exposed across the user base and whether additional updates will further refine the timeline and technical method of compromise. Users should ensure they complete any required password resets, and security teams should monitor for account anomalies while waiting for any further clarifications from the company.