SOC, XDR, and Threat Intelligence

Chainalysis confirms: all users' password hashes and active tokens exposed, key services disabled

Chainalysis, a company whose blockchain analysis tools are used by law enforcement, banks, and exchanges, updated its breach notification on November 4: the names, usernames, password hashes, and active tokens of all users were exposed. The company disabled additional services, including the KYT product interface and API.

  • SourceThe Record
  • Publication DateNovember 5, 2026
  • TypeThreats and Incidents

What happened

Chainalysis initially disclosed the incident on October 30, mentioning an “external actor using offensive agentic techniques” and no evidence of credential access. Around November 2, it preventatively disabled the Reactor investigative tool and Data Solutions product. In a November 4 update, it admitted that all user data had been exposed, some passwords were intercepted in an on-path attack (according to the company, this method was contained), and some KYT accounts were likely accessed without authorization. Approximately 40 minutes after sending this information to clients, the company disabled the KYT interface and API, other address screening products, and the login page due to “unusual activity.”

Chainalysis did not explain what “offensive agentic techniques” mean, did not identify the perpetrator, and did not specify how passwords were hashed or how many users it has. The restoration of KYT and the Address Screening service is planned after collecting lists of trusted IP addresses from clients.

Key findings

  • Exposed: names, usernames, password hashes, and active tokens of all users; some passwords intercepted in an on-path attack; suspected unauthorized access to some KYT accounts.
  • Disabled: Reactor and Data Solutions (from approx. Nov 2), KYT interface and API, other address screening products, login page, and Chain (Beta).
  • Attribution: none; the company mentions “offensive agentic techniques” but does not explicitly confirm that an AI agent led the attack.
  • Recommendations for clients: password reset and API key rotation, logging in only by direct website entry (not from email links), reporting trusted IP addresses for an allowlist.

Why it matters

SafeWave CommentaryChainalysis is a data provider for institutions that themselves must comply with AML requirements – banks, exchanges, and law enforcement. An incident at such a provider is supply chain risk in its purest form: active tokens and client API keys can open the door to their data and compliance processes, and a disruption in KYT operation impacts business continuity. This is the same company whose on-chain analyses were used to attribute the Binance theft – security analytics providers themselves are attractive targets. For institutions using external analytical platforms, the conclusions are practical: inventory of tokens and API keys issued to providers, their immediate rotation in case of an incident, access only from trusted IP address lists, and an action plan for critical compliance service unavailability.