Chainalysis says hackers got password hashes for all its users

Chainalysis, whose blockchain-analysis tools are used by police, government agencies, exchanges and banks to investigate fraud and money laundering, said an outside party obtained account data covering all of its users, including names, usernames, password hashes and active tokens. An Oct. 30 notice said the company saw no sign that credentials had been affected, but by Nov. 4 it had told certain customers that an on-path attack exposed some passwords and had locked those accounts. After abnormal activity, Chainalysis took KYT, Address Screening and its login page offline; Reactor, Data Solutions and Chain Beta were also down. To resume transactions, customers must allowlist trusted IP addresses, reset passwords and rotate API keys.