In just 5 days, the story went from only email addresses being leaked to every user's tokens being exposed
📣 盘面异动群里喊
Late at night on November 4, blockchain analytics firm Chainalysis updated its security notice, admitting that names, usernames, password hashes, and valid tokens belonging to all users had been exposed
The company's main business is helping exchanges, banks, and law enforcement trace where hackers' money goes 🦖
The first notice, on October 30, said only that user IDs, names, and email addresses had been leaked. It explicitly stated there was no evidence that authentication credentials or session tokens had been accessed
On November 2, the Reactor and Data Solutions products were proactively taken offline
At 9:50 a.m. on November 4, the company changed its story, admitting that a man-in-the-middle attack had exposed some customers' passwords
At 10:30 a.m. that day, KYT's user interface and API, along with other address-screening products and the login page, were taken offline
By 11 p.m., the notice had changed to say that every user's password hashes and valid tokens had been exposed
Over those 5 days, the story shifted from non-sensitive information all the way to all credentials ⚠️
What's even more worth noting is the company's position
Its customers aren't retail users. They're compliance departments at exchanges, risk-control teams at banks, and on-chain investigators
Every day, these people use KYT to decide whether an address should be blocked or allowed through
What do valid tokens mean? They mean someone could use them to view these decision rules, and even see which addresses had been flagged 🚨
The company says there is no evidence that investigative data was accessed or attribution data altered
But that only means they haven't found evidence so far—it doesn't mean it didn't happen 💥
An organization dedicated to tracking hackers' money had a copy of its own keys made first
Chainalysis has published figures showing that suspected North Korea-linked attacks accounted for 89% of reported crypto hacking losses this year. In 2021, that figure was 15%
The people tracking the money have become the ones being tracked. The division of labor across this industry is now crystal clear
For ordinary users, the immediate takeaway is simple: don't reuse the same password across multiple platforms, and especially don't use your email password to sign up for an exchange
For institutions, this is a supply-chain wake-up call: the risk-management tools you depend on are themselves accounts that need to be risk-managed
There are two things to watch next: first, whether there are any suspicious login records after KYT comes back online; second, whether API key rotation covers all subaccounts
Do you think a breach at a security company like this will make the industry more cautious—or embolden attackers? 👀
Every day, I bring you the latest in crypto security—not just what happened, but also the logic and opportunities behind the headlines 👀🚀
📣 盘面异动群里喊
Late at night on November 4, blockchain analytics firm Chainalysis updated its security notice, admitting that names, usernames, password hashes, and valid tokens belonging to all users had been exposed
The company's main business is helping exchanges, banks, and law enforcement trace where hackers' money goes 🦖
The first notice, on October 30, said only that user IDs, names, and email addresses had been leaked. It explicitly stated there was no evidence that authentication credentials or session tokens had been accessed
On November 2, the Reactor and Data Solutions products were proactively taken offline
At 9:50 a.m. on November 4, the company changed its story, admitting that a man-in-the-middle attack had exposed some customers' passwords
At 10:30 a.m. that day, KYT's user interface and API, along with other address-screening products and the login page, were taken offline
By 11 p.m., the notice had changed to say that every user's password hashes and valid tokens had been exposed
Over those 5 days, the story shifted from non-sensitive information all the way to all credentials ⚠️
What's even more worth noting is the company's position
Its customers aren't retail users. They're compliance departments at exchanges, risk-control teams at banks, and on-chain investigators
Every day, these people use KYT to decide whether an address should be blocked or allowed through
What do valid tokens mean? They mean someone could use them to view these decision rules, and even see which addresses had been flagged 🚨
The company says there is no evidence that investigative data was accessed or attribution data altered
But that only means they haven't found evidence so far—it doesn't mean it didn't happen 💥
An organization dedicated to tracking hackers' money had a copy of its own keys made first
Chainalysis has published figures showing that suspected North Korea-linked attacks accounted for 89% of reported crypto hacking losses this year. In 2021, that figure was 15%
The people tracking the money have become the ones being tracked. The division of labor across this industry is now crystal clear
For ordinary users, the immediate takeaway is simple: don't reuse the same password across multiple platforms, and especially don't use your email password to sign up for an exchange
For institutions, this is a supply-chain wake-up call: the risk-management tools you depend on are themselves accounts that need to be risk-managed
There are two things to watch next: first, whether there are any suspicious login records after KYT comes back online; second, whether API key rotation covers all subaccounts
Do you think a breach at a security company like this will make the industry more cautious—or embolden attackers? 👀
Every day, I bring you the latest in crypto security—not just what happened, but also the logic and opportunities behind the headlines 👀🚀
