Chainalysis Breach Exposes User Passwords and Live Tokens
Chainalysis is restoring services after a cyberattack exposed password hashes and live tokens for all users, forcing banks and exchanges to face screening gaps.
Blockchain analytics firm Chainalysis suffered a major cybersecurity breach that exposed sensitive data for all of its customers, including full names, email addresses, usernames, password hashes, and live tokens. The company first disclosed the attack on October 30, 2026, initially reporting that only non-sensitive data had been accessed. By November 4, the company updated its assessment to confirm that an on-path attack and offensive agentic techniques had compromised customer passwords.
To contain the incident, Chainalysis took several key products offline, including Reactor, Data Solutions, Chain (Beta), and the Know Your Transaction (KYT) user interface and API. This outage created critical screening gaps for banks and cryptocurrency exchanges that rely on KYT to detect sanctions violations and money laundering. While the company stated there is no evidence that attribution or investigation data was manipulated, it has instructed all affected users to rotate API keys and reset passwords.
Restoration of some services began on November 5 via a trusted-IP allowlist. Chainalysis has since started a phased restoration of KYT and Address Screening. No threat actors have claimed responsibility for the attack, and the stolen data has not yet appeared on the dark web.
