Blockchain analytics firm Chainalysis says an intrusion first disclosed on October 30 has grown: names, usernames, password hashes and live tokens for all of its users were exposed, according to reports this week. The company has taken several products offline and is forcing password resets. Anyone who uses its tools for compliance or investigations should treat the situation as active.
What happened
Chainalysis first told customers on October 30 that an outside actor had used what it called “offensive agentic techniques.” At that stage, as American Banker and crypto.news describe it, the company said it had no evidence that authentication credentials or session tokens were compromised.
That position changed in later updates to its incident post. Per American Banker, Reactor and Data Solutions were taken offline on Monday, November 2, and a November 4 update said the company had found exposed names, usernames, password hashes and live tokens for all users. The same day, the KYT user interface and API, other address screening products and the login page were also taken offline after what the company called abnormal activity. A separate on-path attack had earlier exposed a subset of customer passwords. Chainalysis has not explained how that incident relates to the wider exposure, according to American Banker.
Restoration of KYT and Address Screening through an IP allowlist was planned for Thursday, November 5, but American Banker reported the status page still showed maintenance that afternoon.
Who is affected
Chainalysis says it has more than 1,500 customers in 70 countries. No count of affected accounts has been given, and a spokesperson would not say how many KYT accounts were accessed, American Banker reported. Headlines saying “credentials” were exposed need care: the reports describe password hashes and live tokens, not plaintext passwords. Chainalysis says it has no evidence that investigation data was accessed or that its attribution data was manipulated.
What to do
From the company’s guidance as reported by The Hacker News and crypto.news:
- Send trusted IP addresses to support@chainalysis.com or your account team so they can be added to the allowlist.
- Reset your password, and rotate API keys where appropriate. Reset emails sent to some customers cannot be used yet, and affected accounts are locked.
- Change the password on any other system where you reused your Chainalysis password.
- Do not follow links in unsolicited reset emails, and turn on two-factor authentication if your organization has not.
Our analysis, not from the company: because live tokens were exposed, customers should also review their own logs for unusual KYT or API activity going back to at least October 30, and treat any phishing that mentions Chainalysis with extra suspicion, since names and usernames are now in an attacker’s hands.
What we still do not know
The attacker has not been identified, and The Hacker News says it is unclear who is behind it. American Banker notes the October 30 email did not specify that AI drove the attack, so the “agentic” label is not independently established. It is not stated what type of token was exposed, what hashing method was used, how many accounts were affected, or when customers learned of the token exposure. Sources also differ on when the exposure was discovered. The incident post has been updated several times, so details may change.
Sources: The Hacker News, Nov. 6, 2026; American Banker, Nov. 5, 2026; crypto.news, Nov. 6, 2026; Chainalysis incident post, first published Oct. 30, 2026 (cited by the reports above).
Leave a Reply