> ## Content Index
> Fetch the complete content index at: https://theainewsfiles.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Chainalysis says names, password hashes and live tokens for all users were exposed
- URL: https://theainewsfiles.com/chainalysis-says-all-users-credentials-live-tokens-exposed/
- Published: 2026-11-07T15:57:15.000Z
- Updated: 2026-11-07T15:57:15.000Z
- Description: On 30 October Chainalysis said it had found no evidence of unauthorised access to credentials or session tokens. Its 4 November update said live tokens and password hashes for all users were exposed.
- Author: J E Cowie
- Tags: News

Chainalysis says that on Monday 2 November it discovered that names, usernames, password hashes and live tokens for all of its users had been exposed to a malicious actor. The company says it continues to have no evidence that investigations data was accessed or that its attribution data was manipulated. That is a long way from where its account of the incident stood a few days earlier.

## From 'non-sensitive' data to all users

Chainalysis first publicly disclosed the incident on Friday 30 October. That statement said it had found no evidence of unauthorised access to authentication credentials or session tokens. The email to impacted customers that it published that day said some non-sensitive customer data, such as user IDs, full names, email addresses and organisation role labels, had been accessed. The same email said it had found no indication of access to clear-text passwords, MFA secrets or user session tokens.

On 4 November Chainalysis sent an email to customers whose passwords were exposed in an on-path attack. The email said the attack exposed a subset of customer passwords, that the vector had been contained and remediated, and that there was no evidence the recipient's account had been improperly accessed. Ars Technica explains that an on-path attack, also known as an adversary-in-the-middle attack, is one where a hacker gains access to infrastructure relaying traffic between two parties. BleepingComputer frames it as a Man-in-the-Middle attack. Later on 4 November, Chainalysis said that on the Monday it had discovered the all-users exposure.

## How the attack was carried out

Chainalysis says an external actor used offensive agentic techniques to access its systems and internal tools. Ars Technica describes the actor as using AI agent-assisted offensive techniques, and says the company has given no details about the AI agents used. Chainalysis describes the incident as an ongoing multifront cyberattack and cites an industry-wide rise in AI-driven cyberattacks. It says the incident is not related to the Binance crypto theft.

Ars Technica says the source of the on-path attack is unknown and that it is unclear whether the data was TLS encrypted.

## Services taken offline, and restored

In its 2 November update, Chainalysis said it had proactively taken Reactor and Data Solutions offline as a precaution, and had decided to keep its compliance transaction monitoring products running during the investigation.

![Rows of server racks inside a data centre, as a plain photograph](https://theainewsfiles.com/content/images/2026/11/shot2_rows-of-server-racks-inside-a-data-centr.jpg)

Server racks in a data centre. Illustrative image.

On 4 November abnormal activity led Chainalysis to take KYT, both its user interface and API, along with address screening products and the login page offline. As of its 10:30 AM EST update that day, Reactor, Data Solutions and Chain (Beta) were still offline. In its later update that evening it said it was directly notifying customers whose KYT accounts appeared to have been accessed without authorisation.

On 6 November Chainalysis began restoring access to KYT and Address Screening in a phased approach. It says it is working around the clock with external experts to restore Reactor and Data Solutions. Unchained reported that as of 6 November those two services stayed offline, and that the post gives no date for their return. By Unchained's count, the incident post carries six dated entries.

## What customers are being asked to do

- Chainalysis asks customers to submit trusted IP addresses for an allowlist.
- It says all users will have to reset passwords and rotate API keys, as applicable, before registering transactions.
- Its 4 November email told customers whose passwords were exposed that their accounts were being locked as a precaution.
- In its 30 October email it recommended that customers enable two-factor authentication.

## Who is affected, and what is not yet clear

BleepingComputer says Chainalysis provides blockchain analysis tools to trace cryptocurrency transactions and investigate crimes such as fraud, ransomware and money laundering. It lists law enforcement, government agencies, financial institutions, insurance companies and cryptocurrency businesses among the customers. Ars Technica names the FBI, ICE, the US Air Force, Microsoft, Coinbase and Barclays among high-profile customers.

Ars Technica says it is unclear whether the data theft exposed customers to additional threats. It also says Chainalysis did not explain why it waited to disclose the all-users data theft, and that a company representative declined to comment beyond its blog post. Unchained says Chainalysis has not given a user count or said how many KYT accounts were accessed, and that the post does not define live tokens.

## Sources

Gatlan, S. (2026) 'Chainalysis says breach exposed credentials for all customers', BleepingComputer, 6 November 2026, available at: [https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/](https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/?ref=theainewsfiles.com) (Accessed: 7 November 2026).

Goodin, D. (2026) 'Chainalysis says hackers stole credentials and tokens for all of its customers', Ars Technica, 6 November 2026, available at: [https://arstechnica.com/security/2026/11/chainalysis-says-hackers-stole-credentials-and-tokens-for-all-of-its-customers/](https://arstechnica.com/security/2026/11/chainalysis-says-hackers-stole-credentials-and-tokens-for-all-of-its-customers/?ref=theainewsfiles.com) (Accessed: 7 November 2026).

Team, C. (2026) 'Updated Nov 6: Chainalysis Security Incident Information', Chainalysis, 30 October 2026, available at: [https://www.chainalysis.com/blog/security-incident-october-30/](https://www.chainalysis.com/blog/security-incident-october-30/?ref=theainewsfiles.com) (Accessed: 7 November 2026).

Unchained (2026) 'Chainalysis Starts Reopening Compliance Tools Behind IP Allowlists in Sixth Breach Update', Unchained, 6 November 2026, available at: [https://unchainedcrypto.com/chainalysis-starts-reopening-compliance-tools-behind-ip-allowlists-in-sixth-breach-update/](https://unchainedcrypto.com/chainalysis-starts-reopening-compliance-tools-behind-ip-allowlists-in-sixth-breach-update/?ref=theainewsfiles.com) (Accessed: 7 November 2026).

## Picture credits

- Top picture: An office building in Vancouver, not Chainalysis. Illustrative image. Photo: NNECAPA ([CC BY 2.0](https://creativecommons.org/licenses/by/2.0/?ref=theainewsfiles.com)), via Flickr ([source](https://www.flickr.com/photos/23163410@N02/2830785109?ref=theainewsfiles.com))
- Server racks in a data centre. Illustrative image. Photo: Robert Scoble ([CC BY 2.0](https://creativecommons.org/licenses/by/2.0/?ref=theainewsfiles.com)), via Flickr ([source](https://www.flickr.com/photos/35034363287@N01/2340202215?ref=theainewsfiles.com))