Chainalysis, the blockchain analytics firm that police forces, banks and crypto exchanges call when stolen cryptocurrency needs tracing, has confirmed the worst version of its October security incident. Password hashes and live session tokens belonging to all of its users were exposed to an attacker — a disclosure that arrived a full week after the company first told customers about the breach, and five days after it first said no credentials had been touched.
As of the company’s November 7 update, its core investigation and transaction-screening products are back online. Two products are not. And several of the most important questions — which hashing algorithm protects the stolen passwords, what a live token could do inside a customer account, and who is behind the attack — remain unanswered.
What Chainalysis confirmed
Late on Wednesday, November 4, Chainalysis added a single sentence to the incident page it had been updating since October 30: “certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor.” The company dates its discovery of the broader exposure to Monday, November 2 — the same day it pulled its Reactor investigation platform and Data Solutions product offline as a precaution.
That sentence reversed the tone of the first disclosure. On October 30, Chainalysis said it had found no evidence that investigation content, authentication credentials or session tokens had been accessed. It also stressed that the incident had no connection to the recent crypto theft at Binance. Five days later, the same page described live tokens in an attacker’s hands. The company has not explained the two-day gap between discovering the wider exposure on November 2 and disclosing it on the evening of November 4.
The company draws one firm line. In a statement quoted by BleepingComputer, Chainalysis said: “At this time we continue to have no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated.” Attribution data — the links between crypto addresses and the people and companies behind them — is the company’s core product, and investigators build cases on it. But the phrase “at this time” carries weight, given that the same page expressed similar confidence about credentials on October 30, and that confidence did not hold.
A timeline that kept getting worse
The incident page reads as a running log, and almost every update widened the damage:
October 30: Chainalysis detects an external actor using what it calls “offensive agentic techniques” to reach its systems and internal tools. Customer data touched: user IDs, full names, email addresses and organisation role labels. No evidence of credential or token access at that point.
November 2: The broader exposure is discovered. Reactor, Data Solutions and Chain (Beta) are taken offline, and outside security experts are engaged. Compliance products keep running because of their role in detecting money laundering.
November 4, 9:50 a.m.: Customers are emailed about an “on-path attack” — an attacker sitting between two systems and reading their traffic — that exposed a subset of customer passwords. The company says the vector was contained and remediated, and accounts are locked.
November 4, 10:30 a.m.: Abnormal activity is detected on the transaction screening products. KYT (the user interface and API), address screening products and the login page go offline. The password reset flow stops working.
November 4, 11:00 p.m.: Names, usernames, password hashes and live tokens for all users are confirmed exposed. Some customers are told directly that their KYT accounts appear to have been accessed without authorisation. Restoration is planned for the next day.
November 6, 3:30 a.m.: Phased restoration of KYT and Address Screening begins. Customers must submit trusted IP addresses for an allowlist, then reset passwords and rotate API keys.
November 7, 1:50 p.m.: Reactor, KYT (UI and API) and Address Screening are back online with enhanced security. Data Solutions and Chain (Beta) remain offline, with no return date given.
What was actually exposed — and why tokens matter more than hashes
Four categories of data left Chainalysis’s control, according to the company: names, usernames, password hashes and live tokens. The earlier notice also listed user IDs, email addresses and role labels. Together they give an attacker a map of who works where, which role they hold and how to reach them — and, for a firm whose customers include law enforcement and government agencies, which investigations may be live.
The password hashes carry a risk that is hard to judge, because Chainalysis has not said which hashing algorithm it uses. A slow, salted scheme buys customers time; a fast, unsalted one buys almost none. The company told customers to reset the password on any other site where they reuse it — advice that points at the real danger, since analysts who handle seizure warrants and sanctions work are exactly the people whose reused passwords an attacker would want.
The live tokens may matter more. A token generally lets a person or program act as a logged-in user without re-entering a password, which means a valid token can sidestep a password reset entirely if the company does not revoke it. Chainalysis has not specified what an intruder could see or change with a live token, or how many KYT accounts the attacker entered. That is why the required API-key rotation is the step customers should treat as non-negotiable. The same week brought a reminder that AI is now part of the attack surface on both sides: while Chainalysis blames “agentic” techniques for its breach, OpenAI’s GPT-6 Cyber security model found 948 Linux exploits while staying in scope, showing how fast AI-driven security work is moving.
Which products are back online — and which are not
Product status is where roundups disagree, so it deserves a careful read. Summaries dated November 5 and 6 still list Reactor as offline; Chainalysis’s own November 7 update supersedes them.
Reactor, the investigations tool that traces funds and identifies who is behind transactions, is back online with enhanced security. KYT, the transaction monitoring service that produces risk scores and alerts, is back online in both its interface and API, with reconnection steps required. Address Screening, which checks wallet risk exposure, is back as well. Data Solutions, which delivers blockchain data into customers’ own systems, and Chain (Beta) remain offline, with no restoration date given.
Restored products do not simply switch back on. Customers receive an email with instructions to reconnect in a specific way: trusted IP allowlisting first, then password resets and API-key rotation before registering any transactions. The shutdowns are incident response, not retirements — Chainalysis has announced no product discontinuation, renaming or price change.
Why this breach reaches past Chainalysis
Chainalysis says it serves more than 1,500 customers in 70 countries. BleepingComputer describes the customer list as law enforcement, government agencies, financial institutions, insurers and crypto businesses worldwide. A credential store covering that base is a high-value target for anyone who wants to know who is investigating whom — and an analyst’s name, role and valid token could hint at which investigations are live.
The timing hurt. The breach disclosure landed in the same week that compliance teams were already stretched: CISA’s November exploited-vulnerabilities wave forced emergency patching of Zyxel, WordPress and Apple flaws, and the Chainalysis incident took the transaction-screening tools those same teams rely on offline for days. Public-sector data has been leaking all autumn, and agencies that depend on Chainalysis tools now face one more vendor-side question on top of their own exposure.
There is also a trust question that outlasts the outage. Chainalysis supplies evidence to law enforcement: its attribution data underpins seizures, freezes and indictments. If an attacker had altered those links, every downstream case that relied on them would face questions. No independent party has published an audit of Chainalysis’s systems, and the company says only that it is working with outside security experts. Customers who run investigations on Reactor have to take the company’s word for now — and a written post-incident report from those experts would settle the question faster than any further blog update.
The “agentic attack” claim — and the questions still open
Chainalysis says an external actor used “offensive agentic techniques,” and its first customer email cited an industry-wide rise in AI-driven cyberattacks. But the company never defined the phrase and never stated outright that AI drove this intrusion. “Agentic” typically refers to AI software that can carry out multistep tasks on its own — and security vendors have a reason to attribute a breach to novel AI tooling, because it implies the defence was reasonable and the attack was unusual.
Without technical indicators, customers cannot test that framing. They can only note that the same page reported an on-path attack — an old technique — alongside the agentic one. The pattern is familiar across the industry this year: AI is being built into defensive tools, like Tencent’s Hy4 open-source model, which trains for defence rather than attack, while attackers adopt the same technology. And just as invisible watermarking is now on by default for Grok API text, the industry is racing to label and trace AI-generated output — including, now, AI-driven attacks.
Here is what the company has not said, as of November 7: how many KYT accounts the attacker accessed, and for how long; which hashing algorithm protects the stolen password hashes; what a live token could do inside a customer account; who is behind the attack, and how they got in; and when Data Solutions and Chain (Beta) will return. No ransomware encryption has been reported, and no ransom group has claimed the breach.
What Chainalysis customers should do now
If your organisation uses Chainalysis, the company’s own instructions are the starting point — but they are not the whole checklist:
1. Submit trusted IPs and reconnect the official way. Send your trusted IP addresses to the allowlist contact or your account team, then follow the reconnection email exactly. Do not click password-reset links in unexpected emails.
2. Reset passwords — everywhere they were reused. Change your Chainalysis password once access is restored, and reset the same password on every other service where it was reused. A hash in an attacker’s hands is a credential-stuffing list.
3. Rotate every API key. Treat this as non-negotiable. Tokens and keys can outlive a password reset, so rotate them before registering any new transactions.
4. Review KYT and Reactor activity since October 30. Look for logins, queries or case access that do not match your team’s work, and report anything odd to your IT or security team immediately.
5. Watch for targeted phishing. The exposed data — names, roles, email addresses — is a ready-made spear-phishing list. Expect messages that reference real investigations, real colleagues and real Chainalysis workflows.
Bottom line
The Chainalysis breach is a case study in how a disclosure can get worse in stages: four data fields on October 30, then password hashes and live tokens for every user by November 4, with two products still offline on November 7. The company’s products are mostly back, and it says no investigation data was touched — but the most consequential details, from the hashing algorithm to what the stolen tokens could do, are still undisclosed. For customers, the response is straightforward: reconnect through the official process, reset passwords, rotate keys, and audit activity back to October 30. For everyone else, it is a reminder that the firms guarding the crypto ecosystem hold credentials worth stealing — and that an “agentic” attack, whatever it turns out to mean, is now a phrase on a real incident page.
