Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services

Chainalysis Discloses Wider Credential Exposure

Blockchain analysis firm Chainalysis has revealed that its investigation into an ongoing, multi-front cyberattack found that names, usernames, password hashes and live tokens were exposed for all users. The company describes an "on-path attack" and says the attack vector has since been addressed.

The update follows an October disclosure in which an external actor used agentic offensive techniques to gain unauthorized access to Chainalysis systems and internal tools.

Services Taken Offline

While investigating, Chainalysis removed access to several products:

• Reactor and Data Solutions
• The Know Your Transaction (KYT) user interface and API
• Other address screening products
• The login page

Accounts of impacted users are locked as a precaution, so self-service password resets are not currently possible.

Chainalysis says it has no evidence that investigations data was accessed or that attribution data was manipulated. It has not named the attacker, and says the incident resembles attacks on many other tech platforms in recent weeks.

What Customers Should Do

• Contact Chainalysis support or your account team with trusted IP addresses so they can be allowlisted.
• After allowlisting, reset your password and rotate API keys.
• Change passwords on any other service where the same credentials were reused.
• Expect all users to reset passwords and rotate API keys as Chainalysis hardens its systems.

Broader Context

The incident fits a pattern of AI-driven attacks against technology vendors. Reporting on the disclosure notes that Chainstack, OpenCode, Warp and WorkOS have reported similar incidents, some involving the autonomous pentesting tool ARTEX. Microsoft has also described threat actors using agentic AI to scan public GitHub repositories for exposed secrets and to exfiltrate data from Azure Key Vault, with activity ongoing since August 2026. Google and Wiz describe "LLMjacking," where stolen AI platform access is resold through "LLM mixers."

IP addresses reported as suspected of testing stolen keys, useful for log hunting:

23.106.46.239
38.246.114.118
104.243.32.50
31.57.201.201

Takeaways for Defenders

• Treat any compromise of an API-driven vendor as a token and key rotation event, not only a password reset.
• Hash exposure still matters: weak or reused passwords can be cracked offline.
• Search logs for the listed IPs and for unusual API key use dating back to October.
• Restrict API keys by source IP where the vendor supports it.

Sources

• The Hacker News