TLDR
- Chainalysis said password hashes and live tokens for all users were exposed to a hacker.
- The firm took KYT, Reactor, Data Solutions and address screening offline.
- Restoration of KYT and Address Screening was set to begin Nov. 5 using trusted IP allowlists.
- All users must reset passwords, and API keys will be rotated where appropriate.
- The company says it has no evidence that investigation data or attribution data was altered.
Chainalysis has said that hackers exposed password hashes and live tokens belonging to all of its users. The blockchain analytics firm shared the update on Nov. 4 at 11 p.m. ET. It said it learned of the exposure on Monday.
Chainalysis: Names, Usernames, Password Hashes, and Valid Tokens of All Users Were Exposed; Some Plaintext Passwords Also Leaked
Blockchain analytics firm Chainalysis disclosed in an updated security incident notice that the names, usernames, password hashes, and valid… pic.twitter.com/cjDr3k0dln
— Wu Blockchain (@WuBlockchain) November 6, 2026
The data also included customer names and usernames. The company said a malicious actor had access to this information. It has not said how many users or organizations are affected.
The latest update goes further than the company’s first report. On Oct. 30, Chainalysis said an attacker had used “offensive agentic techniques” to enter its systems. At that time, it said only basic details like user IDs, names, emails and roles were accessed.
How the Company Plans to Let Customers Back In
Chainalysis is not simply switching its services back on. It plans to restore KYT and Address Screening access starting Nov. 5. Customers must first send trusted IP addresses to their account team or support staff.
Once an address is on the allowlist, customers can reset their passwords. They can also rotate their API keys. Every user will need to reset a password as part of this process.
The company has not given a restoration date for Reactor or Data Solutions. Both products went offline on Nov. 2 for added security checks. At that point, the company kept its transaction monitoring tools running.
That changed two days later. After adding new monitoring, Chainalysis saw abnormal activity in its screening systems. It then shut down the KYT user interface, the KYT API, other address screening products and its login page.
Chainalysis said it is contacting customers whose KYT accounts appear to have been accessed without permission. It also took its Chain (Beta) service offline.
Earlier on Nov. 4, the company confirmed an “on-path attack” had exposed passwords for a subset of customers. This type of attack intercepts messages between a user and a service. Chainalysis said it had contained that method and was locking affected accounts until passwords were changed.
A password hash is a stored form of a password. A live token can let a person use a service without typing a password again. The company has not said which hashing method it used or what kind of tokens were involved.
Chainalysis has hired outside security experts. It is also using large language models to review its own systems.
The company said it has found no sign that confidential investigation data was accessed. It also said its blockchain attribution data was not changed.
Other Crypto Security Incidents in the Same Week
Chainalysis said the breach is not linked to the $6.3 billion theft at Binance on Oct. 29. It described its own incident as an “ongoing multifront cyberattack.”
Mercado Bitcoin, a Brazilian exchange, was attacked on Nov. 2. The company said about $38 million in crypto was stolen. Chainalysis said it helped coordinate the freezing of nearly $10 million of that amount.
On Nov. 5, Binance revoked API keys tied to the trading platform SignalPlus. SignalPlus had reported a security incident. It later said some affected accounts did not have required IP whitelisting.
Binance and Deribit also disabled connected credentials as a precaution. Chainalysis told customers to avoid links in unexpected password reset emails. It also asked users who reused their Chainalysis password elsewhere to change it.
The company recommended two-factor authentication for any organization that has not turned it on. It asked customers to report odd messages or account activity to their security teams. Its investigation is still ongoing.
