NEWS

Chainalysis Says Breach Exposed Credentials for All Customers

Chainalysis says an attack on its systems exposed names, password hashes and live tokens for all users, forcing products offline and credential resets.

Dylan H.

News Desk

November 6, 2026
2 min read
Chainalysis Says Breach Exposed Credentials for All Customers

Summary

Blockchain intelligence firm Chainalysis says a recent attack on its systems and internal tools exposed credentials and live tokens for all customers. The company first described the incident as limited, then widened its scope in later updates. It attributes the exposure to an "on-path attack," a man-in-the-middle technique.

Timeline

  • Initial disclosure: Chainalysis said attackers using AI tools accessed names, email addresses, user IDs, and organizational role labels through "offensive agentic techniques."
  • November 2: The company found that names, usernames, password hashes, and live tokens for all users had been exposed.
  • November 4: Chainalysis locked accounts as a precaution and asked users to reset passwords. It then took the login portal offline after finding further abnormal activity.
  • November 6: The company said access will be restored only after customers provide trusted IP addresses.

Impact

Exposed data: names, usernames, password hashes, and live tokens for every user. Chainalysis says it has no evidence that investigations data was accessed or that its blockchain attribution data was manipulated.

Offline services include the login portal, Reactor, Data Solutions, the Know-Your-Transaction (KYT) user interface and API, and address screening products. SecurityWeek reports Chainalysis is contacting customers who show signs of unauthorized KYT access.

Live tokens are the urgent risk. Unlike password hashes, they can be used directly against APIs without cracking anything. Customers in compliance and investigations roles also handle sensitive case data, which makes their accounts attractive targets.

What Customers Should Do

  1. Email support@chainalysis.com or your account team with the trusted IP addresses to allowlist.
  2. Reset your password once access is restored.
  3. Rotate API keys and any tokens issued by Chainalysis.
  4. Complete these steps before registering any transactions.
  5. Review your own logs for unusual API use or screening results since the incident began.
  6. Reset any other account that shares a password with your Chainalysis login.

Sources

  • BleepingComputer, "Chainalysis says breach exposed credentials for all customers" (November 6, 2026)
  • SecurityWeek, "In Other News" (November 6, 2026)