Chainalysis says hackers took credentials and live tokens for all its users

Chainalysis, the blockchain-analytics company whose software is used by exchanges, banks and investigators to screen crypto transactions, says attackers obtained names, usernames, password hashes and live tokens for all of its users. That is far wider than what the company said when it first disclosed the incident a week ago. According to the company's own running incident notice, several products have been taken offline and every user will have to reset their password and rotate API keys.

The company says it has no evidence that investigations data was accessed or that its attribution data was manipulated. It has not said who is behind the attack, and neither do we.

The timeline, in the company's words

The notice is a single page updated in place. Reading its dated entries in order shows how the scope changed:

• Friday, October 30. Chainalysis said an external actor used what it called "offensive agentic techniques" to reach its systems and internal tools. Exposed, it said, was non-sensitive data: user IDs, full names, email addresses and organization role labels. It reported no evidence that investigation content, credentials or session tokens were accessed, and said the incident was not related to the recent Binance theft. BleepingComputer reported the same day's disclosure.
• Monday, November 2. Reactor and Data Solutions were taken offline as a precaution pending third-party security assessments. Its Know Your Transaction (KYT) compliance monitoring stayed up under close watch.
• Wednesday, November 4, 9:50 a.m. ET. The company said an "on-path attack" had exposed a subset of customer passwords, that the vector was contained, and that affected accounts were locked.
• Wednesday, November 4, 10:30 a.m. ET. After abnormal activity, KYT (interface and API), other address-screening products and the login page went offline.
• Wednesday, November 4, 11:00 p.m. ET. The notice said that "names, usernames, password hashes and live tokens for all Chainalysis users" were exposed, and that this was discovered on Monday. Customers whose KYT accounts appeared to have been accessed without authorization were notified directly.
• Friday, November 6, 3:30 a.m. ET. KYT and Address Screening were being restored in phases. Reactor and Data Solutions remained offline while outside experts harden the systems, with no restoration date given.

The contradiction is worth stating plainly. On October 30 the company reported no evidence that credentials or session tokens had been touched. Its November 4 entry says the opposite, and also says the exposure was found on November 2. BleepingComputer and The Hacker News both noted that the later "all users" wording sits awkwardly beside the earlier "subset of passwords" line, and the notice does not reconcile them.

What customers are being told to do

1. Send trusted IP addresses. To get KYT and Address Screening access back, customers contact support@chainalysis.com or their Chainalysis account team with the IP addresses they want on an allowlist.
2. Reset passwords and rotate API keys. Once access is granted, all users must reset passwords and rotate API keys "as applicable" before registering transactions.
3. Change reused passwords elsewhere. Anyone who used their Chainalysis password on another service is told to change it there too.
4. Expect more controls. Chainalysis says it will require additional account protections.

The October guidance still applies: enable two-factor authentication, treat unexpected password-reset requests or login prompts as suspicious, and be wary of anyone impersonating Chainalysis, including offers of fund-recovery help. BleepingComputer's first report carried that scam warning.

One practical wrinkle: the notice says reset emails were temporarily unusable on November 4, so the order matters. Allowlisting comes first, then the reset.

Who is hit, and how hard

The affected group is every Chainalysis user, not a sample. That includes compliance teams at exchanges, payment companies and financial institutions that run transactions through KYT, and investigators who rely on Reactor. For the compliance users the immediate cost is operational: screening and monitoring that was down on November 4 is only returning in phases, and the notice asks customers to submit IP addresses before regaining access. Firms that have regulatory obligations to screen transactions should document the outage and any manual procedures they used, and ask their account team what Chainalysis recommends.

The credential exposure carries a second-order risk: a live token or an API key stored in a customer's own systems is only as safe as the rotation that follows. Customers who have integrated Chainalysis APIs into internal tools will need to find every place a key lives, which is the slow part of any rotation.

What is still unknown

• How many customers. Chainalysis says "all users" but has not published a count. Earlier coverage noted the number of affected customers had not been disclosed.
• Which tokens and which hashing. The notice does not say what kind of live tokens were taken or how the passwords were hashed. We are not speculating on either.
• The attacker. The Hacker News wrote that it is unclear who is behind the attack. We have no verified attribution and are not offering one.
• A technical write-up. None has been published, and we have deliberately left out any detail that would help someone repeat the attack.
• Restoration of Reactor and Data Solutions. No date.

The company's notice is the primary source here and may change again. We will update this story if it does.

Sources: Chainalysis incident notice, "security-incident-october-30" (updates through November 6, 2026 at 3:30 a.m. ET); BleepingComputer, October 31 and November 6, 2026; The Hacker News, November 6, 2026. We did not independently verify the company's account. This is news reporting, not security or investment advice; affected customers should follow Chainalysis's instructions and their own security teams.