Chainalysis ties restored access to new passwords and keys
Chainalysis is restoring customer access after its security breach through trusted address lists and mandatory credential changes. Users must reset passwords and rotate applicable API keys before registering transactions. The recovery follows expanded disclosures about exposed authentication data and the shutdown of several services after further unusual activity.
Artificial Intelligence··Midday
Trusted addresses govern the return to service
Chainalysis, a provider of blockchain investigation tools, is requiring customers to supply trusted internet protocol addresses as it restores access following a breach. Support staff or account teams add those addresses to an allowlist. Once admitted, users must reset passwords and rotate application programming interface keys where applicable before registering transactions. The November 6 update makes these steps conditions of restored use.[1], [2]
Additional activity preceded the shutdowns
The recovery follows the precautionary locking of accounts and the discovery of further abnormal activity. The login portal and several products were taken offline, including Reactor, Data Solutions, the Know-Your-Transaction interface and address-screening services. The company is working to bring its investigation and data products back online while adding account protections. Its customers include law enforcement agencies, financial institutions, insurers and cryptocurrency businesses.[1]
Credential exposure widened the incident
Initial disclosures concerned names, email addresses, user identifiers and organizational roles. Later updates added usernames, password hashes and live authentication tokens for all users. Chainalysis says it has found no evidence of access to investigative data or manipulation of blockchain attribution information. It also attributes the intrusion to AI tools and an on-path attack that intercepts communications. These remain the company’s account of the incident and investigation.[1]
