Chainalysis Breach Widens: Password Hashes and Live Tokens for All Users Exposed

What happened

The notice was updated in stages. Chainalysis first disclosed the breach on Oct 30, saying an external attacker used "offensive agentic techniques" to enter its systems and internal tools, and that user IDs, full names, email addresses and organization role labels had been accessed, with no evidence that authentication credentials or session tokens were accessed. On Nov 2 the company found the exposure was wider and took Reactor and Data Solutions offline the same day; an update at 11 p.m. on Nov 4 confirmed that names, usernames, password hashes and live tokens for all Chainalysis users had been exposed, reversing the Oct 30 finding.

On response and recovery: the company said it has addressed the attack vector and added proactive monitoring. On the morning of Nov 4, some customers were emailed that a subset of passwords had been exposed in an "on-path attack"; the KYT interface and API, address screening products and the login page then went offline, and password resets were temporarily impossible. Phased restoration of KYT and Address Screening began at 3:30 a.m. on Nov 6, limited to customers who registered trusted IP addresses; at 1:50 p.m. on Nov 7, Reactor, KYT and Address Screening were back online, while Data Solutions and Chain (Beta) remained offline. Every user will have to reset passwords and rotate API keys, and customers whose KYT accounts appear to have been accessed without authorization have been contacted directly.

On limits and context: the company said it still has no evidence that investigation data was accessed or attribution data manipulated; it has not identified the attacker, named the tooling used, published indicators of compromise or explained how its password hashes were protected. Chainalysis said this incident is separate from the Binance theft of more than $6 billion. Agentic attacks in the same period also hit Chainstack, OpenCode, Warp and WorkOS, and Microsoft said attackers used an agentic framework to search GitHub for exposed secrets, progressing in one case from scanning keys to exfiltrating data from Azure Key Vault within five minutes.

Key facts

1. First disclosure: Oct 30, 2026, an external attacker used "offensive agentic techniques" to enter the company's systems and internal tools
2. Initial scope: user IDs, full names, email addresses and organization role labels; the company said it had found no evidence that credentials or session tokens were accessed
3. Widened scope: the broader exposure was found on Nov 2; an update at 11 p.m. on Nov 4 confirmed names, usernames, password hashes and live tokens for all users were exposed
4. On-path attack: on the morning of Nov 4, some customers were emailed that a subset of passwords was exposed in an "on-path attack"; the company said the vector was addressed
5. Services taken offline: Reactor, Data Solutions, the KYT interface and API, address screening products and the login page
6. Restoration: phased restoration of KYT and Address Screening began at 3:30 a.m. on Nov 6; Reactor, KYT and Address Screening were back online at 1:50 p.m. on Nov 7
7. Still offline: Data Solutions and Chain (Beta) had not returned as of Nov 7
8. User actions: every user must reset passwords and rotate API keys; KYT restoration is limited to customers who registered trusted IP addresses
9. Not confirmed: the company said it still has no evidence that investigation data was accessed or attribution data manipulated
10. Not disclosed: the attacker's identity, the tooling used, indicators of compromise and how password hashes were protected; the company said the incident is separate from the Binance theft