Chainalysis, a developer of tools for tracking cryptocurrency transactions and investigations, has reported a breach of its own systems. An attacker gained access to platform user data, including names and email addresses. No evidence of access to investigation materials has been found so far.
The company published a statement on October 30. The incident was discovered within a month; the exact date of the breach and the number of affected users have not been disclosed.
What makes cryptocurrency tracking service data valuable
Seeing the movement of cryptocurrency and identifying who is behind a transaction are different tasks. For example, on the Bitcoin network address balances and transaction history are public, but the addresses themselves do not contain owners' names.
Specialized analytics helps to match transactions, cluster related addresses, and establish their connection to real market participants. Chainalysis calls this process attribution: blockchain analysis is supplemented with off-chain information to identify the person or organization controlling an address.
Attribution, however, has varying degrees of reliability. An address may be controlled by an exchange serving many clients, so identifying the operator of a wallet does not always mean determining the ultimate owner of the funds.
Access to such analytics could potentially help select targets for subsequent attacks or reveal what connections an investigation has already established. However, Chainalysis has not disclosed the attacker's motive, and such access has not been confirmed.
What data was actually affected
According to the company, access has been confirmed to user identifiers, full names, emails, and role designations within organizations. The specific records affected for each client are still being clarified.
This is information about users of the analytics platform. It cannot automatically be considered a list of owners of the cryptocurrency wallets under investigation. Chainalysis's clients include government agencies, cryptocurrency exchanges, and financial institutions.
Based on preliminary investigation results, the company has found no evidence of access to relationship graphs, notes, case materials, transaction or query results, plaintext passwords, multi-factor authentication secrets, or user session tokens.
However, names, work emails, and roles could help prepare targeted fraudulent communications purporting to be from support or colleagues. This is a potential risk, not an established consequence of this incident.
Investigation continues
Chainalysis has engaged external cybersecurity experts and is addressing vulnerabilities. Users are advised to be vigilant about unexpected password reset requests and login confirmations, and organizations without two-factor authentication should enable it.
The company separately stated that the incident is not related to the recent cryptocurrency theft from Binance. Clients will be provided with additional information as the analysis is completed.
