Chainalysis: password hashes and live tokens of all users exposed

How it happened

Chainalysis says it "detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools". It later adds that an "on-path attack" exposed a subset of customer passwords. The initial entry point is not public.[1][2] Checked 8 Nov 2026

What was stolen

First user IDs, full names, email addresses and organisation role labels. Then, in the November 4 update: "names, usernames, password hashes and live tokens for all Chainalysis users". This contradicts the first statement that session tokens were not accessed. Chainalysis says there is no evidence that investigation data was accessed.[1] Checked 8 Nov 2026

Who was impacted

All Chainalysis users, whose number is not disclosed. Customers whose KYT accounts appear to have been accessed are notified directly. Reactor, Data Solutions, KYT and address screening were taken offline.[1][2] Checked 8 Nov 2026

Threat actor

Not attributed. Unknown. Chainalysis says the incident is unrelated to the Binance theft.

Timeline

1. 30 Oct 2026Chainalysis discloses unauthorized access by an external actor using offensive agentic techniques; it says only non-sensitive customer data was accessed. [1]
2. 2 Nov 2026Reactor and Data Solutions are taken offline. [1][2]
3. 4 Nov 2026Chainalysis says an on-path attack exposed a subset of customer passwords, then that password hashes and live tokens for all users were exposed. KYT and address screening go offline after abnormal activity. [1]
4. 6 Nov 2026KYT and address screening come back in phases. All users must reset their passwords and rotate their API keys. [1]