Chainalysis breach — all users' names, password hashes and live tokens exposed via 'agentic' attack
Severity: high · Patch status: no-fix-needed · Since 2026-11-05
Chainalysis disclosed on Oct 30, 2026 that an external actor used 'offensive agentic techniques' to gain unauthorized access to its systems and internal tools. In a Nov 5 update it confirmed that customer information including names, usernames, password hashes and live authentication tokens for all users was exposed to a malicious actor. Some passwords were exposed via an on-path interception attack, and some customers' KYT (Know Your Transaction) accounts appeared to have been accessed. The company took Reactor, Data Solutions, KYT, Address Screening and its login page offline, is requiring password resets and API key rotation with IP allowlisting, and says it has no evidence investigations or attribution data was accessed or manipulated. Its 1,500+ customers include law enforcement, regulators and national security organizations. Attacker identity and full scope remain unclear.
What to do
- Reset Chainalysis passwords and rotate API keys immediately once the login page is restored
- Access the Chainalysis login page directly, not via links in password-reset emails
- Submit trusted IP addresses for the allowlist to enable product restoration
- Audit KYT and Reactor account activity for unauthorized access
- Rotate any sessions/tokens tied to Chainalysis integrations and monitor for anomalous transaction-screening gaps
Sources
All live incidents on Threat Watch
