Chainalysis breach: every user's password hash and live tokens were exposed, the company now says

When a bank checks a crypto deposit for criminal links, or police follow stolen coins, Chainalysis software is often doing the tracing. Now the company that helps others follow hackers has told its own users that one reached their login data.

In the Chainalysis breach’s latest turn, a 4 November update (11 p.m. US Eastern) said names, usernames, password hashes and live tokens “for all Chainalysis users” were exposed to a malicious actor. The company says it discovered this on Monday, 2 November. Every user must now reset their password, and rotate API keys where used, before registering transactions again.

Chainalysis says more than 1,500 customers trust it, and American Banker reports they are in 70 countries. They include exchanges, banks, regulators and police. Its tools are part of how the crypto industry screens money and follows stolen funds.

How the Chainalysis breach grew from names to every login

The first post, on 30 October, said an outside attacker using what Chainalysis called “offensive agentic techniques” got into its systems and internal tools. It had reached user IDs, full names, email addresses and role labels. It found no evidence then of access to investigation content, login credentials or session tokens. It said the incident was not related to the recent Binance theft.

On 2 November it took Reactor, its investigations tool, and Data Solutions offline.

On 4 November, three updates came in one day. At 9:50 a.m. Eastern, it said an “on-path attack”, where someone secretly sits between a user and a website, had exposed some customers’ passwords. That route was contained and those accounts locked. At 10:30 a.m., after “abnormal activity”, it took KYT, its payment-screening service, other screening products and the login page offline.

The 11 p.m. update covered all users. Chainalysis says it is contacting KYT customers whose accounts appear to have been accessed without permission. It still has no evidence that investigations data was accessed or its attribution data changed.

On 6 November, KYT and Address Screening began returning in phases, only for customers’ trusted internet addresses on an allowlist. Reactor and Data Solutions stayed offline. That was the latest status when we checked on 7 November.

The questions this security incident leaves open

Chainalysis has not said how the attacker first got in, how long they had access, or how many accounts were actually used. It has not named the hash or token type, or said whether any bank or police account was reached. It has not said whether law enforcement is involved, or why its 30 October finding changed. A spokesperson told American Banker: “We are not sharing additional information beyond what has been published in the blog.”

“Offensive agentic techniques” is the company’s own phrase; American Banker notes the email did not say AI carried out the attack. Chainalysis says outside security experts and large language models are helping a wider security review.

If you use Chainalysis, reset first

A password hash is a scrambled copy of your password. Weak passwords can sometimes be guessed back from it. A live token is a digital pass that lets software act as a logged-in user without a password, until it is cancelled. So Chainalysis asks every user to:

• reset the password through the normal login page, never a link in an email;
• rotate API keys: cancel the old keys your systems use and issue new ones;
• send trusted IP addresses to Chainalysis or your account team;
• change the same password anywhere else you reused it;
• turn on two-factor authentication, as the company urged on 30 October.

For other crypto holders, the effect is indirect. Exchanges use screening tools like KYT, and investigators use Reactor to trace stolen funds, as after the Binance theft. Our reading: while those tools are offline, some checks and investigations could slow down.

Open updates earn credit; the shifting scope needs answers

On balance, Chainalysis has done much right. It posted six public updates in eight days, most with exact times. It took products offline when it saw risk, and told users exactly what to do.

The harder part is the shifting scope. Its customers are compliance teams and investigators who must judge their own risk, often for regulators. They need the how and the how long. Chainalysis itself called this “similar to many other tech platforms in recent weeks”, and the Northflank hack showed the same risk to stored secrets.

In our view, the lesson reaches beyond crypto. A first “no passwords affected” statement can change. When a service you use reports a breach, reset early and switch on two-factor.

Watch for Reactor and Data Solutions to return, and for Chainalysis to say how the attacker got in. For a company whose work is tracing what others hide, that full account may be the update its customers need most.