Chainalysis has updated its security incident disclosure, confirming that password hashes and live authentication tokens were exposed during a breach previously thought to affect only non-sensitive data.