By Blockchain analytics company Chainalysis has confirmed that names, usernames, password hashes and valid authentication tokens associated with all its users were exposed during a cyberattack, significantly expanding the scope of its previously disclosed security incident.
In an update published late November 4, 2026, the company acknowledged that attackers had accessed sensitive authentication information, reversing its October 30 assessment that credentials and session tokens remained unaffected.
Chainalysis also confirmed that some customer passwords were exposed through an interception technique known as an on-path attack. The company described the intrusion as involving offensive agentic techniques, although it has not disclosed the specific tools used or established the extent of artificial intelligence involvement.
The disclosure raises security concerns because Chainalysis provides blockchain investigation, transaction monitoring and compliance services to cryptocurrency exchanges, financial institutions and government agencies. The company serves more than 1,500 institutional customers globally.
Chainalysis Expands Breach Disclosure as Credentials Are Compromised
Chainalysis initially disclosed the incident on October 30, reporting that an external attacker had gained unauthorized access to internal systems and tools. At that stage, the company identified exposed information including user IDs, names, email addresses and organizational roles.
However, its subsequent investigation revealed that the compromise extended to password hashes and live authentication tokens. Unlike plaintext passwords, password hashes are cryptographic representations of credentials, although weaker passwords may still be recoverable through offline attacks.
Exposed authentication tokens can present additional risks because certain tokens may allow account access without requiring users to enter their passwords again. Chainalysis has not disclosed the hashing algorithm used or the precise capabilities of the compromised tokens.
The company separately notified customers whose passwords were exposed through an on-path attack, which involves intercepting communications between users and online services. Chainalysis said that attack method had been contained and remediated.
Affected accounts were locked as a precaution, and customers were instructed to reset their passwords. The company also advised users to change credentials on other platforms if they had reused their Chainalysis passwords.
Critical Compliance Services Taken Offline Following Suspicious Activity
The breach has disrupted several Chainalysis products used by cryptocurrency businesses and investigators. On November 2, the company temporarily suspended its Reactor investigation platform and Data Solutions services while conducting additional security assessments.
On November 4, Chainalysis detected abnormal activity and took its Know Your Transaction platform, including its user interface and API, offline. Other address-screening products and the company’s login page were also temporarily disabled.
Chainalysis acknowledged that some KYT customer accounts appeared to have been accessed without authorization and said those customers were being contacted directly. The company announced plans to restore KYT and Address Screening access through an allowlisting process involving trusted customer IP addresses.
All users will be required to reset passwords and rotate API keys where appropriate. Despite the expanded breach disclosure, Chainalysis said investigators had found no evidence that confidential investigation records were accessed or that blockchain attribution data had been manipulated.
The company has not identified the attackers, disclosed the total number of affected users or established whether compromised credentials were exploited beyond the suspicious activity already identified. Chainalysis has engaged external cybersecurity specialists to investigate the intrusion and strengthen its infrastructure.
The incident highlights the security risks facing cryptocurrency compliance providers, whose systems contain sensitive information and support financial crime detection across multiple organizations. Service interruptions may also complicate automated transaction screening for institutions relying on Chainalysis infrastructure.
The company previously stated that the attack was unrelated to the separate cryptocurrency theft involving Binance. For affected organizations, restoring secure access and verifying the integrity of connected systems remain immediate priorities. The broader consequences will depend on the investigation’s findings and whether additional unauthorized account activity is discovered.