Chainalysis On-Path Attack Exposes All User Credentials and Live Tokens, Shuts KYT and Reactor

The breach began as an ongoing multi-front operation using offensive agentic techniques. Chainalysis identified the vector, applied fixes, locked accounts and required password resets plus API key rotation. Customers must now connect from trusted IPs on an allowlist before regaining access. Services remain offline while additional monitoring is deployed.

Microsoft telemetry shows the same campaign scanned GitHub for secrets then moved to Azure Key Vault exfiltration in five minutes using two IPs: 199.19.77[.]84 and 199.19.77[.]18. Service principal sign-ins hit dozens of Entra ID tenants. The activity matches ARTEX-linked operations reported since August 2026 against other platforms.

Chainalysis holds attribution datasets that directly map wallet clusters to real entities. Exposure of live tokens creates immediate risk of fabricated on-chain evidence or targeted deanonymization of law enforcement and compliance users. Existing data protection rules lack specific controls for firms whose core product is sensitive transaction intelligence.

Restoration will require hardened authentication and continuous secret scanning. Regulators are likely to demand breach notification timelines and third-party audits of how attribution data is segmented from customer portals.