Chainalysis now says password hashes and live tokens for all its users were exposed

On November 1 we wrote that Chainalysis, whose crypto-tracing software is used by police, regulators, exchanges and banks, had found an intruder in its internal tools who saw users’ names, emails and role labels. At the time, the company said it had found no sign that passwords, MFA secrets or session tokens were reached. That has changed. In updates on November 4, Chainalysis said password hashes and live tokens for every one of its users were exposed, that some customer passwords were caught in transit, and that some accounts on one of its products appear to have been accessed. Here’s what it has said since.

What changed

All of this comes from the updates Chainalysis has added to its incident page (times are U.S. Eastern):

• Monday, November 2: Chainalysis took its Reactor investigations tool and its Data Solutions product offline as a precaution while outside experts did more security checks. It kept its transaction-monitoring products running because of their role in spotting money laundering, and said it was watching them closely.
• Wednesday, November 4, 9:50 AM: it began emailing some customers to say an “on-path attack,” where someone intercepts traffic between a user and a service, had exposed “a subset of customer passwords.” It said that route had been contained, locked those accounts and required a password reset. It described the incident as an “ongoing multifront cyberattack.”
• 10:30 AM: after spotting “abnormal activity,” it took KYT (its Know Your Transaction monitoring tool, both the website and the API), other address screening products and its login page offline. That meant customers who had just been told to reset their password couldn’t.
• 11:00 PM: it said it had discovered on Monday that “certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor.” It also said it is directly notifying customers whose KYT accounts “appear to have been accessed without authorization.”

Chainalysis says it still has “no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated.” Attribution data is its labelling of which crypto addresses belong to whom, the core of what investigators rely on.

It hasn’t said how many users it has, whether every type of data was exposed for every user, how the passwords were hashed, or what it means by “live tokens.” The Record notes the company also hasn’t said whether the intercepted passwords, the exposed hashes and tokens, and the KYT account access involve the same attacker or method. A spokesperson told The Record they couldn’t share more than the blog. According to its website, as The Record notes, Chainalysis serves more than 1,500 customers in law enforcement, crypto, finance, regulation and national security.

Why this is a bigger deal than the first notice

A password hash is a scrambled form of a password. Depending on how it was made, weak passwords can sometimes be recovered from it by guessing at scale. A live token is what a service uses to recognize you as already signed in, so a stolen one can let someone in without any password. Put together with names and work emails, that’s a much more useful set for an attacker than the contact details the company described on October 30. The users here are often investigators working on sensitive cases, which makes careful targeting more likely.

What happens next

Chainalysis says it planned to start restoring KYT and Address Screening on November 5, for customers who send their trusted IP addresses to be put on an allowlist. Those users will then be able to reset passwords and rotate API keys. Reactor and Data Solutions have no return date yet. When they come back, every user will have to reset their password and rotate API keys as needed, and accounts will need “additional protections.”

What you can do

If you or your organization uses Chainalysis:

1. Reset your Chainalysis password when access returns, by going to the login page directly. Chainalysis asks users not to click links in password-reset emails.
2. Change that password anywhere else you used it, now. Don’t wait for Chainalysis to come back online.
3. Rotate API keys used to register transactions or call Chainalysis services, once the company lets you, and check your systems for any calls you don’t recognize.
4. Send trusted IP addresses to your account team or support@chainalysis.com if you need KYT restored. Use contact details you already have.
5. Turn on two-factor authentication if your organization hasn’t yet, as the company recommended in its first notice.
6. Be wary of messages that use the breach as a reason to act. Expect phishing that mentions password resets, API keys or account recovery.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each service its own address, so a reset email that lands at the wrong address is an easy sign of a fake. Frame never collects or stores the leaked records themselves.

Related coverage

• Chainalysis says an intruder reached its internal tools and saw customer names and emails: our first report, from the company’s October 30 notice, when it said no credentials had been reached.
• WorkOS says an AI-assisted attack reached its sales tool: another company that described automated, AI-assisted access the same week. No link between the two has been reported.
• How infostealers steal your sessions, and why a new password isn’t enough: why a stolen live token can matter as much as a password.

Sources

• Chainalysis, Chainalysis Security Incident Information (updated November 4, 11:00 PM EST), October 30 to November 4, 2026
• The Record, Chainalysis warns all users hit in cyber breach involving ‘agentic’ techniques, November 5, 2026