[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBp4D-JGxglRK3ZdbxQ5Q_YjzXa6_ovTybSFNdlD2E_I":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"12151912-225e-4be4-8f35-ecc148a015fa","Chainalysis says breach exposed credentials for all customers","chainalysis-says-breach-exposed-credentials-for-all-customers-68f16a","Blockchain intelligence firm Chainalysis says a recent attack on its systems and internal tools has exposed credentials and live tokens for all customers. [...]","Blockchain intelligence firm Chainalysis disclosed that attackers using AI-powered techniques compromised its systems, exposing usernames, password hashes, and live authentication tokens for all customers. The company initially downplayed the incident as limited to non-sensitive metadata but later revealed the full scope included credentials exposed via a Man-in-the-Middle attack. Chainalysis took its login portal, Reactor, and Data Solutions offline as a precaution while investigating further abnormal activity, requiring customers to provide trusted IPs and reset credentials before regaining access.","Chainalysis breach exposed credentials and live tokens for all customers via MITM attack.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fchainalysis-says-breach-exposed-credentials-for-all-customers\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F06\u002F0_Chainalysis.jpg","2026-11-06T14:17:07+00:00","2026-11-06T15:00:22.441338+00:00",9,[17,20,23,25,28,30],{"name":18,"type":19},"Chainalysis","vendor",{"name":21,"type":22},"Reactor","product",{"name":24,"type":22},"Data Solutions",{"name":26,"type":27},"Know-Your-Transaction (KYT)","technology",{"name":29,"type":19},"Binance",{"name":31,"type":19},"Ledger","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":32,"icon":34,"name":35,"slug":36},null,"Breaches","breaches",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":55,"value":56,"context":57},"email","support@chainalysis.com","Chainalysis support contact for breach response and trusted IP allowlist registration",[18,29,31],{"controls":60,"vendors":148},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":91,"name":92,"problem":93,"products":94},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":120,"name":121,"problem":122,"products":123},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",[],{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":161},"chainalysis-breach-exposes-all-customer-credentials-via-mitm-attack","Chainalysis Breach Exposes All Customer Credentials via MitM Attack","Attackers leveraging AI-powered techniques executed a Man-in-the-Middle attack against Chainalysis, compromising usernames, password hashes, and live authentication tokens for its entire customer base. Critically, the company initially understated the breach scope, disclosing only 'non-sensitive metadata' before later revealing the full credential exposure — a failure that delayed customer response and eroded trust. This incident illustrates that live session tokens are as dangerous as passwords, since attackers can hijack authenticated sessions without ever cracking a hash. The delayed and incomplete disclosure compounded the harm, leaving customers exposed longer than necessary. Organizations handling sensitive financial intelligence data must treat any credential exposure as a worst-case scenario from the outset.",[154,155,156,157,158,159,160],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","GDPR Article 32","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)",{"GDPR Article 32":162,"NIS2 Article 21(2)(b)":163,"MITRE ATT&CK T1566: Phishing":164,"NIST SP 800-53 SI-2: Flaw Remediation":165,"CIS Control 17: Incident Response Management":166,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":167,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":168},"Article 32 requires appropriate technical measures to ensure a level of security appropriate to the risk, including encryption and confidentiality of credentials — the exposure of password hashes and live tokens for all customers represents a direct failure of this obligation.","NIS2 mandates incident handling procedures including timely and accurate reporting; Chainalysis's delayed and initially incomplete disclosure of the full breach scope is precisely the type of failure this article is designed to prevent for entities handling critical digital infrastructure.","AI-powered credential-harvesting techniques used in this breach align with adversary-in-the-middle and credential interception tactics catalogued under ATT&CK, underscoring the need for detection controls targeting session hijacking and token theft at the network layer.","AI-powered attack techniques exploiting authentication weaknesses highlight the need for continuous identification and remediation of security flaws in authentication infrastructure before they can be weaponized.","Chainalysis's initial understatement of the breach scope reflects a failure in structured incident response; this control requires organizations to have defined procedures for accurately scoping, communicating, and escalating security incidents in a timely manner.","The MitM attack vector exploited weaknesses in the authentication and transport layer that should have been identified and mitigated through systematic technical vulnerability management processes.","This control requires strong authentication mechanisms and session management practices that, if implemented (e.g., phishing-resistant MFA, short-lived tokens), would have prevented attackers from leveraging stolen live authentication tokens to maintain access."]