Key Takeaways
- Chainalysis said on November 4, 2026, that names, usernames, password hashes, and live tokens for all Chainalysis users were exposed to a malicious actor, an exposure the company discovered on November 2.
- Chainalysis took its Reactor investigations tool and Data Solutions product offline on November 2, 2026, and took its KYT transaction monitoring service, other address screening products, and its login page offline on November 4 after detecting abnormal activity.
- Chainalysis first disclosed the breach on October 30, 2026, saying an external actor used "offensive agentic techniques" to gain access to its systems and internal tools, a term the company has not explained.
- All Chainalysis users must reset their passwords and rotate API keys before registering transactions, the company said on November 6, 2026, as it began restoring KYT and address screening in phases.
What happened
Chainalysis, a blockchain analytics company, said in an update late on November 4, 2026, US Eastern time, that "certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor." The company said in its incident post that it discovered the exposure on Monday, November 2.
A password hash is a scrambled form of a password. Some hashes can be cracked to recover the original password, and active login tokens may let attackers into accounts without a password, The Record noted. Chainalysis did not explain what it meant by "live tokens" or say how the passwords had been hashed, according to The Record.
Chainalysis said it still had no evidence that any investigations data had been accessed or that its attribution data had been manipulated.
The company first disclosed the incident on October 30. It said then that earlier in the month it had detected an external actor using "offensive agentic techniques" to gain unauthorized access to its systems and internal tools. At that point it said it had found no evidence that authentication credentials or session tokens had been accessed, and that user IDs, full names, email addresses, and organization role labels had been accessed.
Products taken offline
On November 2, Chainalysis took its Reactor investigations tool and its Data Solutions product offline as a precaution, the company said. It kept its compliance transaction monitoring products running, saying they are important to detecting money laundering across the cryptocurrency ecosystem.
On November 4, Chainalysis emailed some customers to say that an "on-path attack" had exposed a subset of customer passwords. In an on-path attack, an attacker intercepts communications between users and a service, The Record explained. The company said the method had been contained and that it was locking the affected accounts as a precaution.
Later that day, Chainalysis said it had detected abnormal activity. It took the user interface and the application programming interface (API) of its Know Your Transaction (KYT) service offline, along with other address screening products and the login page. KYT is used to monitor cryptocurrency transactions for suspicious activity, according to The Record. Chainalysis said it was directly notifying customers whose KYT accounts appear to have been accessed without authorization.
On November 6, Chainalysis said it had begun restoring access to KYT and address screening in phases, with more customers expected to regain access over the following hours. It said it was still working to restore Reactor and Data Solutions safely, and The Record reported that the company gave no date for bringing them back.
Who is affected
Chainalysis says it has more than 1,500 customers, in sectors that include law enforcement, cryptocurrency, finance, regulators, and national security, according to The Record. Its tools are used by law enforcement, government agencies, cryptocurrency exchanges, and financial institutions to trace cryptocurrency transactions and investigate crimes such as fraud, ransomware, and money laundering, BleepingComputer reported.
The company has not said how many users it has, or whether every category of information was exposed for every user, The Record reported.
What is still unknown
Chainalysis has not identified the attacker. It has not explained what it meant by "offensive agentic techniques" and did not explicitly say its breach was caused by an artificial intelligence (AI) agent, according to The Record. In its first disclosure, the company said it was seeing "an industry-wide rise in AI-driven cyberattacks" and that the incident was similar to those at many other tech platforms in recent weeks.
Chainalysis has also not said whether the password interception, the exposure of hashes and tokens, and the suspected access to KYT accounts involved the same attacker or methods, The Record reported. A company spokesperson told The Record they could not share more than the blog post.
Chainalysis said the incident is not related to the recent crypto theft at Binance.
What customers should do
Chainalysis said all users will have to reset their passwords and rotate API keys, as applicable, before registering transactions. To regain access, customers should send the trusted IP addresses they want on an allowlist to Chainalysis support or their account team, the company said.
The company told customers to go directly to the Chainalysis login page rather than clicking links in password reset emails. It also advised anyone who used the same password on another service to reset it there and choose a unique password.
In its first disclosure, Chainalysis told users to watch for unexpected password reset requests or authentication prompts, and strongly recommended that organizations that have not enabled two-factor authentication do so.