The return of a login page does not mean a cyberattack is over. For Chainalysis, the challenge is precisely to restore services while restoring confidence in access. In its update of 6 November, the company announced the gradual reopening of KYT and Address Screening. Work is continuing on Reactor and Data Solutions.
This case deserves to be read as more than a question of whether data has leaked. A login identity, a password and a means of access used by software do not serve the same purpose. Securing them again therefore requires several actions, not just a new combination of characters.
What Chainalysis has acknowledged
The company announced the incident on 30 October. On 4 November, it expanded its account: information concerning all its users had been exposed to a malicious actor, including names, login credentials, password hashes and active tokens. It is now asking users to reset their passwords and, where applicable, renew their API keys.
This wording does not allow us to conclude that every user lost exactly the same data. Nor does it give the number of people affected. The Record, which examined the successive communications, highlights these two limitations. The number of client organisations and the number of individual users are two different measures.
Why several forms of access need to be renewed
A password is used to prove that you are authorised to log in. A password hash is not a plain-text copy of the password: it is a result calculated from it. Its resistance depends in particular on the method used, which Chainalysis has not specified publicly. As The Record points out, however, some hashes may still make it possible to recover the original password.
Active tokens are a separate matter. Some authentication tokens allow users to retain access without re-entering their password. However, the company has not explained what it means here by “live tokens”. We therefore cannot describe with certainty how they worked in this incident.
An API key, meanwhile, is used for exchanges between software systems. For a client organisation, restoring an employee’s account and restoring an automated connection are two distinct operations. The instruction to renew keys makes this distinction very concrete: the work does not necessarily end at an individual’s login screen.
A gradual recovery, not a general return announced
The official update of 6 November sets out a phased restoration and asks clients to provide their trusted IP addresses through their usual contacts. This controlled access precedes the resumption of operations. This service status should be read as a snapshot in time, liable to change, and not as an announcement that all products are available again.
For user teams, the question then becomes: which service is accessible, under which identity and subject to what new conditions? A connection working for one user does not, by itself, prove that all the organisation’s integrations have been restored. This distinction also helps avoid mistaking a local connection problem for a new attack.
What cannot be claimed
Chainalysis says it has no evidence that investigation data was accessed or that its attribution data was manipulated. This is its finding at the investigation stage, not an external certification that no damage of any kind occurred.
The terminology around artificial intelligence calls for the same caution. The Record notes that the company refers to offensive “agentic” techniques, without precisely explaining the term or confirming that its own breach was carried out by an AI agent. Presenting this case as an entirely autonomous attack would add a degree of certainty that the published evidence does not provide.
Avoiding a second nasty surprise
An announcement about a password reset can also serve as a pretext for a fake support message. After a data breach, the CNIL recommends going directly to official services, watching out for suspicious approaches and protecting accounts with distinct passwords and stronger authentication.
For a business client, the useful first step is therefore to check instructions with its security team and usual contact, rather than follow a link received in a hurry. In this case, vigilance is needed on two fronts: the technical restoration of the service and the reliability of the person offering to help access it.
Illustrative photograph: a physical Casascius coin bearing the Bitcoin symbol; it depicts neither Chainalysis’s premises nor an asset stolen during this incident.
