Chainalysis Admits Breach Exposed Password Hashes and Live Tokens for All Users

Between 4 November and 6 November 2026, blockchain analytics and compliance firm Chainalysis reversed the central assurances of its late-October breach notice and admitted that attackers had compromised names, usernames, password hashes, and live session tokens for all Chainalysis users. In updates posted to its security incident advisory, Chainalysis also disclosed that an "on-path" attack had exposed a subset of customer passwords, and that some Know Your Transaction (KYT) compliance accounts appeared to have been accessed without authorisation.

Related reading: Sony's Japanese ISP Arm Says a Breach Exposed 2.6 Million Records · Spain Logs Its First Data Breach Carried Out by an Autonomous AI Agent.

The escalating incident, which Chainalysis called an "ongoing multifront cyberattack" that began in October with an external actor using AI-driven "offensive agentic techniques", forced the company to pull its main investigative and compliance platforms offline. By 10:30 A.M. EST on Wednesday, 4 November, Chainalysis had shut down Reactor, Data Solutions, the KYT user interface and API, Address Screening, Chain (Beta), and its main login page, according to BleepingComputer.

Chainalysis began restoring KYT and Address Screening in phases at 3:30 A.M. EST on Friday, 6 November, behind IP allowlisting, mandatory password resets, and API-key rotation. Reactor and Data Solutions remained offline as of 6 November while Chainalysis and external security specialists hardened the systems.

Five days from reassurance to a full shutdown

When Chainalysis first disclosed the intrusion at about 5:14 P.M. EDT on Friday, 30 October 2026, it framed the breach as limited. In that initial advisory and an email covered by BleepingComputer on 31 October, Chainalysis said an external actor had used "offensive agentic techniques" earlier in October to gain unauthorised access to systems and internal tools.

At that stage, Chainalysis claimed it had found "no indication that these incidents resulted in the unauthorized access of investigation content (such as graphs, notes, or cases), transaction or query results, passwords in clear text, MFA secrets, or user session tokens." Only "non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform were accessed," the company told customers. Chainalysis also noted that the breach was unrelated to the late-October Binance theft covered in our 30 October report.

That assurance held until Monday. On 2 November, Chainalysis announced publicly that it had taken Reactor and Data Solutions offline "out of an abundance of caution", while leaving KYT online. Two nights later, Chainalysis revealed that on Monday, 2 November, its investigators had discovered internally that names, usernames, password hashes, and live tokens for all users had been exposed to a malicious actor.

Chainalysis has not explained why it waited from Monday until 11:00 P.M. EST on Wednesday to tell customers that every user's password hash and live session token had been exposed. KYT stayed online for those two days.

Forty minutes on Wednesday morning

The public timeline shifted across six updates between 30 October and 6 November 2026:

• Friday, 30 October (~5:14 P.M. EDT): Initial advisory disclosed an October intrusion using "offensive agentic techniques", saying passwords, MFA secrets, and session tokens were untouched.
• Monday, 2 November: Reactor and Data Solutions went offline publicly "out of an abundance of caution", the same day investigators privately found that all users' names, usernames, password hashes, and live tokens were exposed.
• Wednesday, 4 November (9:50 A.M. EST): Chainalysis reported an "ongoing multifront cyberattack", locked accounts where an "on-path attack" exposed passwords, and told those users to reset passwords via the login page.
• Wednesday, 4 November (10:30 A.M. EST): Abnormal activity on screening tools forced Chainalysis to shut down the KYT UI and API, Address Screening, and the main login page.
• Wednesday, 4 November (11:00 P.M. EST): Chainalysis disclosed the Monday all-user exposure, confirmed unauthorised access to some KYT accounts, and asked customers to email trusted IPs to [email protected].
• Friday, 6 November (3:30 A.M. EST): Phased restoration began for KYT and Address Screening behind IP allowlisting, password resets, and API-key rotation; Reactor and Data Solutions stayed offline.

Wednesday morning showed how fast defenders were losing ground. At 9:50 A.M. EST, Chainalysis said the on-path vector "has been contained and remediated" and sent affected users to the login portal to change passwords. Forty minutes later, abnormal activity on the screening tools forced Chainalysis to shut down KYT, Address Screening, and the login page.

The login page was dark. Nobody could reset a password. In its 10:30 A.M. update, Chainalysis wrote: "For customers who just received an email from us instructing you to reset your Chainalysis password, resetting this password won't be possible right now. We still encourage you, where necessary, to reset your password on other systems where you may be reusing credentials."

At 11:00 P.M. EST, Chainalysis replaced the partial password notice with the all-user disclosure, reported by The Hacker News and TechRadar Pro. "On Monday, we discovered certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor," the company wrote.

Live tokens, password hashes, and an on-path interception

Two credential problems sit inside the 4 November disclosures. The Monday discovery covered password hashes and live tokens for all users. A password hash cannot be typed into a login prompt, though attackers can run offline cracking attempts against stolen hashes depending on password strength and the hashing algorithm. Chainalysis has not said which algorithm protected those hashes.

Live session tokens are an immediate problem. A session token is issued after a user passes password and multi-factor authentication checks. Anyone holding a valid live token can impersonate that session against a web app or API until the server revokes the token or shuts the service down. That fits the sequence on 4 November, when Chainalysis saw abnormal activity on its screening tools and confirmed that some KYT accounts appeared to have been accessed without authorisation.

Then there is the "on-path attack" disclosed at 9:50 A.M. EST on Wednesday, which exposed a subset of passwords.

"Also known as an adversary-in-the-middle attack, on-path attacks happen when a hacker gains access to a piece of infrastructure sending traffic back and forth between two parties. Chainalysis has yet to say where the infrastructure compromise occurred and if the data obtained from it was TLS encrypted." Dan Goodin, Senior Security Editor at Ars Technica, on 6 November 2026.

Goodin's question in Ars Technica points to the missing detail. If traffic between a browser and Chainalysis was TLS encrypted, an attacker on an external link would only see ciphertext. Capturing passwords from a subset of users suggests the interception happened at or behind a point where TLS was terminated, such as a reverse proxy, load balancer, or authentication service. We do not know which.

What "offensive agentic techniques" means here

Chainalysis's 30 October advisory, covered by SecurityWeek and Help Net Security, drew attention because of one sentence: "This month, Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools."

In offensive security, agentic tooling means autonomous AI agents that scan repositories, parse credentials, analyse output, and execute follow-on steps without waiting for a human to type each command. Reporting on the breach on 6 November, The Hacker News cited Microsoft Threat Intelligence on autonomous attack frameworks such as ARTEX, which let attackers scan for secrets across multiple repositories faster and "use the agents to analyze the output and conduct follow-on attacks, cutting down on the need for the threat actor to have hands-on-keyboard interactions throughout the attack chain."

Chainalysis has not named the threat actor or the specific agentic tooling used in October. Autonomous agents may have found the initial foothold in internal tools before human operators moved in to intercept passwords and pull the user token store. Or maybe the automated tooling ran deeper into the stack on its own; Chainalysis hasn't said.

Why a Chainalysis outage hits government and banking workflows

Co-founder Jonathan Levin has been CEO of Chainalysis since December 2024, succeeding co-founder Michael Gronager. Across law enforcement, defence, regulators, banks, and crypto exchanges, the company's platforms sit inside daily investigative and compliance work.

Reactor is Chainalysis's visual investigation platform for linking cryptocurrency wallet clusters to identities. Documented US government customers include the FBI, IRS Criminal Investigation (IRS-CI), US Immigration and Customs Enforcement (ICE), the SEC, the DEA, and the US Air Force. KYT and Address Screening provide real-time anti-money-laundering compliance for exchanges and banks; documented private-sector customers include Microsoft, Coinbase, Barclays, and BNY Mellon.

Exposing names, usernames, email addresses, user IDs, and organisation role labels across all users gives an attacker a roster of the investigators and compliance analysts using Chainalysis inside those agencies and banks. Taking the KYT UI and API offline for over 40 hours between 4 November and 6 November also interrupted live screening for institutions that call KYT before clearing crypto transfers. And for the customers whose KYT accounts were accessed without authorisation, the exposure includes whatever queries and alerts sat inside those accounts.

What Chainalysis still has not explained

Chainalysis is drawing a hard line between KYT account access and Reactor investigation data. In its 11:00 P.M. EST update on 4 November, the company said: "While we investigated, we removed access to Reactor and Data Solutions. At this time we continue to have no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated."

Pulling Reactor offline on Monday, 2 November, may have kept the intruder out of active case graphs and attribution records. Customers will still want forensic proof of that boundary.

What to watch as Reactor and Data Solutions stay dark

Several questions remain open after the 6 November phased restoration of KYT and Address Screening. First is when Reactor and Data Solutions will return online, and whether agencies like the FBI, IRS-CI, and the SEC will access them through the same IP allowlisting ([email protected]), password resets, and API-key rotations applied to KYT. We'll see how long the allowlist process takes.

Second is whether Chainalysis discloses the number of KYT accounts accessed without authorisation, the password-hashing algorithm, and the location of the on-path interception. Third is whether any customer reports follow-on compromises from stolen tokens or reused passwords before the login page went down on 4 November. Reactor stayed dark on Friday.

Cover image: Chainalysis co-founder Michael Gronager at Web Summit in Lisbon in November 2022 (photo predates the incident), by Ben McShane / Web Summit via Sportsfile, CC BY 2.0, via Wikimedia Commons.