AI-Assisted Intrusion Steals Live Tokens and Password Hashes for Every Chainalysis Customer

Chainalysis reported that malicious actors accessed sensitive personal information for all of its customers.reported This data includes names, usernames, password hashes and live tokens, following a complex security incident.

The evidence

Chainalysis confirmed that hackers obtained sensitive personal information for all of its users. The company stated that an external actor used AI agent-assisted techniques to gain unauthorised access to internal systems. An earlier email to customers mentioned only non-sensitive data such as user IDs and email addresses were accessed.

The firm later clarified that the scope was far wider. An investigation on Monday revealed that password hashes and live tokens for all users were exposed. This update contradicted the initial assessment that only basic profile information had been compromised. The company described the event as an ongoing multifront cyberattack.

The decision

Chainalysis stated that part of the ongoing multifront cyberattack involved an on-path attack. This technique involves intercepting traffic between two parties by compromising infrastructure in the middle. The company said it had identified and fixed this specific attack vector. However, it has not disclosed where the infrastructure compromise occurred or whether the data was TLS encrypted.

In response to abnormal activity, Chainalysis took down its login page. It also suspended its know-your-transaction service, which monitors cryptocurrency threats in real time. Access to Reactor and Data Solutions services was removed entirely to contain the breach.

What to make of it

The involvement of AI agents in the offensive techniques marks a shift in attack methods. Ars Technica noted this similarity to other platform hacks during the same month. The use of AI to assist in gaining unauthorised access suggests automated or semi-automated intrusion tactics. It remains unclear if this represents a new standard for such attacks.

The exposure of live tokens is particularly significant for platform security. Tokens often grant session access without requiring password re-entry. If these tokens are valid, attackers could potentially bypass standard authentication checks. The company has not confirmed whether these tokens were invalidated immediately after detection.unverified

In practice

Users of Chainalysis services face access disruptions as the company manages the breach. As of the latest update, the company began phasing in customer access to KYT and Address Screening. Chainalysis expected more customers to follow in regaining access. Users should verify their own account security and consider rotating credentials if they share them with other services.