Chainalysis took its KYT service, address screening products and login page offline on November 4 after detecting abnormal activity, expanding its response to exposure from the Chainalysis hack. The blockchain analytics firm notified customers whose accounts appeared to have been accessed without authorization and instructed them to reset passwords and rotate API keys.
Key takeaways
Chainalysis shut down multiple products during its investigation.
An October 30 notice found no evidence of credential or session-token access.
KYT customers must allowlist trusted IP addresses before registering transactions again.
Chainalysis says the incident is separate from the Binance theft.
What the Chainalysis hack exposed
According to the firm, an outside attacker breached Chainalysis systems and internal tools during October, gaining access to user IDs, full names, email addresses and organization role labels .
Its October 30 notice found “no evidence of unauthorized access to investigation content, authentication credentials, or session tokens.” An accompanying customer email also ruled out access to clear-text passwords and MFA secrets.
On November 4, however, Chainalysis told some customers by email that their passwords had been exposed. It locked those accounts and directed users to reset passwords through the normal login page rather than follow links in password-reset emails.
The firm also said it had found no evidence that investigation data was accessed or that attribution data had been manipulated.
Service shutdowns and customer security requirements
Chainalysis removed several products from service while investigating the incident and brought in outside cybersecurity specialists. Reactor and Data Solutions went offline on November 2; compliance transaction monitoring initially remained available because customers use it to detect money laundering.
Once abnormal activity was flagged on November 4, the company responded by taking down KYT’s user interface and API , along with other address screening tools and the login page. At that point, Reactor, Data Solutions and Chain (Beta) were still offline as well.
Customers whose KYT accounts appeared to have been accessed without permission received direct notifications. Chainalysis said it would begin restoring KYT and Address Screening on Thursday, with trusted IP allowlisting required before customers resume registering transactions. They must also reset passwords and rotate API keys.
All users will need to change passwords and API keys when Reactor and Data Solutions return. The firm also advised customers to activate two-factor authentication and remain alert to unsolicited password-reset requests.
Investigation findings and the separate Binance theft
Chainalysis says the exposure in its hack is unrelated to the approximately $6.3 billion Binance theft . Binance linked that separate incident to a compromised laptop belonging to a DevOps engineer.
Police, government agencies, exchanges and banks use Chainalysis software to trace cryptocurrency and investigate fraud, ransomware and money laundering. The shutdowns affected products used for those investigations and compliance checks, while the firm continued to report no evidence of access to investigation data or manipulation of attribution data.
In a separate October 30 post, Chainalysis said suspected North Korea-linked hacks accounted for almost 89% of reported crypto hack losses that year, compared with 15% in 2021.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
