Blockchain analytics firm Chainalysis has significantly updated its account of a recent cybersecurity incident, revealing a broader exposure of customer information than initially reported.
In a late-evening update on November 4, 2026, the company stated that it had discovered certain customer details—including names, usernames, password hashes, and live tokens associated with all of its users—had been exposed to a malicious actor.
This disclosure marks a clear escalation from the company’s original statement, issued on October 30.
At that time, Chainalysis reported that an external actor had used what it described as “offensive agentic techniques” to gain unauthorized access to its systems and internal tools earlier in the month.
The firm indicated that the accessed information consisted of non-sensitive customer data, such as user IDs, full names, email addresses, and organizational role labels for users provisioned on its platform.
Initial findings, the company said, showed no evidence that investigation content, clear-text passwords, multi-factor authentication secrets, or session tokens had been compromised.
Subsequent updates on November 4 revised that picture.
In addition to the password hashes and live tokens now confirmed as exposed for the full user base, Chainalysis reported that a separate “on-path attack”—in which an attacker intercepts communications between users and a service—had exposed plaintext passwords belonging to a subset of customers.
The company said that particular attack vector had been contained and remediated.
Affected customers were being notified, with their accounts locked and mandatory password resets required.
In response to the expanding findings, Chainalysis took protective steps that affected service availability.
While investigating the exposure of names, usernames, password hashes, and live tokens, it removed access to Reactor and Data Solutions.
After detecting abnormal activity, it also took its Know Your Transaction (KYT) tool—both the user interface and API—offline, along with other address-screening products and the login page.
The firm stated it was directly notifying customers whose KYT accounts appeared to have been accessed without authorization.
Chainalysis indicated it planned to begin restoring access to KYT and Address Screening the following day.
Customers were advised to contact the company or their account teams with trusted IP addresses to be placed on an allowlist.
Once access is restored, users will be required to reset their passwords and rotate API keys as needed to register transactions.
The company continues to work with external cybersecurity experts and has been employing large language models as part of a broader security review and system-hardening effort.
Despite the wider scope of exposed credentials-related data, Chainalysis reiterated that, based on the investigation to date, it has found no evidence that investigation content (such as graphs, notes, or cases) was accessed or that its attribution data was manipulated.
The firm has not publicly detailed the hashing algorithms used for the exposed password hashes, the precise nature or capabilities of the live tokens, the number of affected users or organizations, or the full technical methods employed by the attacker beyond the reference to offensive agentic techniques and the on-path attack.
The incident is particularly noteworthy given Chainalysis’s role providing blockchain analytics and transaction-monitoring tools used by financial institutions, cryptocurrency businesses, and law-enforcement and national-security organizations.
Exposed user identities, organizational roles, password hashes, and live tokens raise risks of account takeover, credential-stuffing attacks (especially where passwords are reused), and targeted phishing, even if deeper investigation data remains uncompromised according to the company’s current assessment.
Customers and partners have been urged to remain vigilant for suspicious activity, including unexpected password-reset requests or authentication prompts, and to enable multi-factor authentication where available. As restoration of services proceeds under tighter access controls, the company continues to investigate and update stakeholders.
