Chainalysis breach: all users' names, password hashes and live tokens exposed in agentic-technique intrusion
Severity: high · Patch status: unknown · Since 2026-10-30
Blockchain-analytics firm Chainalysis disclosed on 2026-10-30 that an external actor using what it called 'offensive agentic techniques' had gained unauthorized access to its systems and internal tools. Its first notice described only non-sensitive customer data as accessed (user IDs, names, emails and role labels) and reported no evidence of credential or session-token access. Its update of 2026-11-04 (late evening Eastern time) reverses that scope: certain customer information, including names, usernames, password hashes and live authentication tokens for all Chainalysis users, was exposed to a malicious actor, which it says it discovered on 2026-11-02. A subset of customer passwords was also exposed through an on-path interception attack, which the company says is contained and remediated; those accounts were locked pending a password reset. On 2026-11-04 Chainalysis took its KYT monitoring UI and API, its other address-screening products and its login page offline after abnormal activity, said some KYT accounts appear to have been accessed without authorization, invalidated all Hexagate customer API keys as a precaution and disabled Hexagate login through the shared app.chainalysis.com portal. After a phased, IP-allowlisted return from 2026-11-06, Reactor, KYT and Address Screening were back online on 2026-11-07; all old passwords are expired and every prior KYT and Address Screening API key has stopped working, so users must reset and integrations must switch to newly generated keys. The company says it has no evidence that investigation or attribution data was accessed or manipulated. No attacker is named, the intrusion path and the on-path component are undisclosed, 'live tokens' is not defined, the hashing algorithm is not stated, and the number of affected users is not given. Its 1,500+ customers include law enforcement, regulators and national security bodies.
What to do
- Reset every Chainalysis password now on kyt.chainalysis.com or reactor.chainalysis.com, opened directly rather than through a link in an email; old passwords have been expired
- Generate new KYT and Address Screening API keys (KYT → Tools → Developer → API keys), deploy them to your integrations and confirm transaction registration works; every prior key has been revoked
- Rotate Hexagate API keys in the Hexagate UI; Chainalysis invalidated all of them on 2026-11-04
- Review KYT, Reactor, Hexagate and API activity since early October 2026 for unauthorized logins, new users, changed settings, alert rules or API use, rather than relying only on the direct notice Chainalysis sent to affected KYT accounts
- Reset passwords on any other service where you reused a Chainalysis password, and revoke sessions and tokens tied to Chainalysis integrations
- Enable two-factor authentication on every Chainalysis account (through your account manager if self-service is not available)
- Record the window when KYT, Address Screening or Reactor was unavailable (2026-11-02 to 2026-11-07) and the compensating transaction checks you ran, and re-screen transactions that were registered or released in that window
- Treat unexpected reset emails, login prompts and offers of fund recovery or recruitment as phishing; the names, emails and role labels of your users were exposed
- Ask Chainalysis for the per-organization breakdown of accessed records it promised on 2026-10-30, the meaning of 'live tokens', and the window of the on-path interception, and check them against your user list
Sources
All live incidents on Threat Watch
