Chainalysis Breach Exposes All Users' Credentials
Original title: Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services
AI-driven on-path attack exposed names, usernames, password hashes and live tokens for all Chainalysis users; KYT and login page taken offline.
Chainalysis confirmed an agentic AI attack that exposed credentials for all users. The company took the KYT user interface, Data Solutions, address screening products and login page offline. It is investigating the multi-front breach and planning to restore services with added protections.
Unconfirmed: It is unclear who is behind the attack
- All users' credentials exposed
- KYT and login page taken offline
- Attack similar to incidents at other tech platforms
- Password resets required on other systems
Impact: exposure of all users' names, usernames, password hashes and live tokens
- 1.contact support for restoration
- 2.rotate API keys
- 3.reset passwords on other systems
- Vendors
- Chainalysis
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | llm-routing.com | WS Bedrock keys obtained from two different organizations – llm-routing[.]com (momo) and xingjiabiapi[.]org – both of which offer a wid |
| domain | xingjiabiapi.org | two different organizations – llm-routing[.]com (momo) and xingjiabiapi[.]org – both of which offer a wide selection of frontier models |
| support@chainalysis.com | s Screening, urging customers to contact its support email (support@chainalysis.com) or their Chainalysis account team with trusted IP addresse | |
| ipv4 | 104.243.32.50 | o LLM token abuse and resale - 23.106.46.239 38.246.114.118 104.243.32.50 31.57.201.201 "Threat actors are not only using AI as a too |
| ipv4 | 199.19.77.84 | urces. The sign-in events originated from two IP addresses, 199.19.77[.]84 and 199.19.77[.]18. "The agent successfully conducted ser |
| ipv4 | 23.106.46.239 | Interestingly, the IP address linked to llm-routing[.]com, 23.106.46[.]239, hosted an Artex landing page in mid-October 2026 and has |
| ipv4 | 31.57.201.201 | use and resale - 23.106.46.239 38.246.114.118 104.243.32.50 31.57.201.201 "Threat actors are not only using AI as a tool to conduct a |
| ipv4 | 38.246.114.118 | to be linked to LLM token abuse and resale - 23.106.46.239 38.246.114.118 104.243.32.50 31.57.201.201 "Threat actors are not only usi |
From the original article
5 min read at thehackernews.com
Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users. "While we investigated, we removed access to Reactor and Data Solutions," the company said. "At this time we continue to have no evidence that any investigations data has been accessed
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.