Chainalysis hacked, password hashes and tokens leaked
10-30 Chainalysis said there was no evidence that credentials or tokens had been accessed, acknowledging only that user IDs, full names, email addresses, and organizational roles were exposed.
11-04 Late at night, the same page changed its story: the names, usernames, password hashes, and valid tokens of all users had been exposed.
Five days later. KYT, address screening, the login page, Reactor, and Data Solutions were all taken offline; some KYT accounts were suspected of unauthorized access.
Valid tokens can access accounts without a password or two-factor authentication, so enabling 2FA afterward won’t stop them. To restore access, users must report a trusted IP, then everyone must change their passwords and replace their API keys.
Coincheck and ICONOMI suspended withdrawals due to an outage in their on-chain analytics service. The hashing algorithm, token types, and number of affected users were not disclosed.#chainalysis遭攻击致密码哈希及令牌泄露 $XMR
10-30 Chainalysis said there was no evidence that credentials or tokens had been accessed, acknowledging only that user IDs, full names, email addresses, and organizational roles were exposed.
11-04 Late at night, the same page changed its story: the names, usernames, password hashes, and valid tokens of all users had been exposed.
Five days later. KYT, address screening, the login page, Reactor, and Data Solutions were all taken offline; some KYT accounts were suspected of unauthorized access.
Valid tokens can access accounts without a password or two-factor authentication, so enabling 2FA afterward won’t stop them. To restore access, users must report a trusted IP, then everyone must change their passwords and replace their API keys.
Coincheck and ICONOMI suspended withdrawals due to an outage in their on-chain analytics service. The hashing algorithm, token types, and number of affected users were not disclosed.#chainalysis遭攻击致密码哈希及令牌泄露 $XMR
