Blockchain analytics company Chainalysis confirmed on 4 November 2026 that a major cyber attack exposed usernames, password hashes and live tokens for all customers. The Chainalysis data breach compromised systems through an on-path attack, prompting the firm to take its customer login portal and core cryptocurrency tracking tools offline.
Key points
- Attackers exposed usernames, password hashes, and active session tokens across the entire Chainalysis customer base.
- The company shut down Reactor, Data Solutions, address screening services, and its login portal to contain abnormal activity.
- Chainalysis found no evidence that investigative case graphs or blockchain attribution databases were accessed or modified.
- Customers must submit trusted IP addresses to support teams before regaining access to reset credentials and rotate API keys.
How the attack happened
Chainalysis first disclosed an intrusion on 30 October 2026, stating that an attacker had targeted its systems. The firm initially reported that the perpetrators used artificial intelligence tools alongside what it described as offensive agentic techniques to gain unauthorised entry.
In that first alert, Chainalysis told clients that the incident was limited to non-sensitive identity metadata. The company stated that the intruder had accessed user IDs, full names, email addresses, and organisational role labels, but had not reached authentication credentials, session tokens, or case files.
That assessment changed after further investigation revealed an on-path attack, also known as a man-in-the-middle attack. Chainalysis sent an email notifying customers that the interception had exposed customer passwords. In a message to affected users, the company said: “This attack vector has been contained and remediated.”
What data was exposed
On 4 November, Chainalysis issued an update widening the scope of the incident. The company confirmed that names, usernames, password hashes, and live tokens belonging to all Chainalysis users had been exposed to the malicious actor.
In its initial assessment, Chainalysis said attackers had not gained access to passwords in clear text, multi-factor authentication secrets, or query results. While the company initially believed user session tokens were safe, its later investigation confirmed that live tokens and password hashes were indeed exposed.
Investigators found no sign that intruders accessed active investigation content or altered reference datasets. Chainalysis stated in a security incident update: “At this time we continue to have no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated.”
Systems taken offline
When the password exposure was identified, Chainalysis initially locked user accounts and asked customers to reset credentials. The discovery of further abnormal activity prompted the company to take broader technical measures.
Engineers took the main customer login portal offline to halt unauthorised sign-ins. Chainalysis also disabled Reactor, its main cryptocurrency tracing tool, and took its Data Solutions service down, while shutting down Chain Beta as a precaution.
The shutdown extended to the Know-Your-Transaction system, known as KYT. Chainalysis turned off both the KYT user interface and API, alongside automated address screening tools used by financial firms to monitor wallet transactions.
The outage disrupted operations for organisations worldwide that rely on the software daily. Government departments, law enforcement agencies, financial institutions, insurance firms, and digital asset businesses use Chainalysis tools to investigate crimes such as fraud, ransomware, and money laundering.
Requirements for account recovery
To safely restore access, Chainalysis established network restrictions. The company instructed customers to email support teams with trusted IP addresses so engineers could add them to an allowlist before reopening the login portal.
Once administrators approve those network addresses, users must complete mandatory security steps. Chainalysis confirmed that all users will have to reset their passwords and rotate their API keys before registering transactions or running queries.
The company has begun restoring partial access to KYT and Address Screening tools. Engineers continue working to harden internal systems before bringing Reactor and Data Solutions back into full service.
No threat actors have claimed responsibility for the intrusion, and the stolen information has not appeared on dark web forums. Chainalysis noted that the incident was unrelated to a recent breach at crypto exchange Binance, where North Korean hackers stole approximately $6.34 billion worth of cryptocurrency. The wider digital asset sector has also faced security alerts in recent weeks, with hardware wallet manufacturer Ledger investigating device tampering incidents.
Chainalysis said it is proceeding carefully and monitoring each phase as it restores access to allowlisted customers.
