Chainalysis announced that a coordinated cyber assault resulted in the theft of authentication data for its entire user base. The company’s statement said the breach exposed usernames, password hashes and active tokens belonging to every customer. The intrusion was described as a “multifront cyberattack” that combined several techniques to gain access to internal systems.
According to the firm, part of the operation involved an on-path, or adversary-in-the-middle, attack that revealed a subset of customer passwords. Chainalysis said the vector has been identified and mitigated, but did not disclose where the compromised infrastructure resided or whether the intercepted traffic was protected by TLS encryption.
The breach list includes several high-profile entities. Public disclosures name U.S. government agencies such as the Federal Bureau of Investigation, Immigration and Customs Enforcement and the Air Force, alongside private firms like Microsoft, Coinbase and Barclays. Chainalysis has not confirmed whether the stolen data has been used to launch further attacks against these organizations.
In response, Chainalysis disabled its login portal and the real-time monitoring service that tracks cryptocurrency transaction risks. Access to its Reactor and Data Solutions platforms was also revoked. The company began restoring limited functionality for Know-Your-Transaction (KYT) and address-screening tools, requesting customers to submit trusted IP addresses for an allow-list and to prepare for mandatory credential resets once access is re-established.
The investigation, which began after abnormal activity was detected on Monday, has not yet uncovered evidence that the attackers accessed investigation data or altered Chainalysis attribution records. Uncertainty remains about the origin of the on-path compromise and whether the perpetrators could decrypt the intercepted traffic, a capability that would grant broader control over the firm’s infrastructure.
Chainalysis disclosed the breach on Wednesday, two days after the initial discovery, without explaining the delay. The firm also provided no technical details about the AI agents cited as part of the attack. A company spokesperson declined to comment beyond the information posted on the firm’s blog, leaving many questions about the scope and motives of the intrusion unanswered.