Chainalysis: Password Hashes Exposed for All Users

On 4 November 2026, Chainalysis, a major blockchain analytics firm used by exchanges, banks, regulators and law-enforcement agencies, published a series of updates that sharply widened what it had first disclosed on 30 October. According to the company, names, usernames, password hashes and live tokens for all of its users were exposed to a malicious actor. The same day it took Know Your Transaction (KYT), other address-screening tools and its login page offline after abnormal activity. Some KYT accounts, it said, appear to have been accessed without authorisation.

What changed on 4 November#

The 30 October notice had been narrower. Chainalysis then said an external actor had used "offensive agentic techniques" to reach its systems and internal tools, and that some non-sensitive customer data — user IDs, full names, email addresses and organisation role labels — had been accessed. At that time it reported no evidence of access to investigation content, clear-text passwords, MFA secrets or session tokens. It also said the incident was unrelated to the recent Binance theft.

By 4 November that picture had changed. In an update timed 11:00 p.m. EST (05:00 on 5 November, Europe/Zurich), the firm said it had discovered on the previous Monday that password hashes and live tokens for all users were among the exposed material. Earlier that day, at 9:50 a.m. EST (15:50 Zurich), it emailed a subset of customers that an "on-path attack" — interception of traffic between users and the service — had exposed some of their passwords. Chainalysis said that vector had been contained and remediated, locked the affected accounts, and required password resets. Forty minutes later, abnormal activity led it to pull KYT (UI and API), other screening products and the login page offline. Customers who had just been told to reset could not do so immediately.

Reactor and Data Solutions had already been taken offline on 2 November as a precaution. Chainalysis said it planned to start restoring KYT and Address Screening on 5 November for customers who submit trusted IP addresses to an allowlist, after which users can reset passwords and rotate API keys. It gave no date for Reactor, Data Solutions or Chain (Beta). Every user, it said, will eventually have to reset passwords and rotate API keys as appropriate.

What remains unknown#

Chainalysis has not named an attacker. It has not said how the exposed passwords were hashed, what it means by "live tokens", how many users it has, or whether every data category was exposed for every user. The Record, citing the company's website, notes that Chainalysis says it serves more than 1,500 customers across law enforcement, cryptocurrency and finance, regulators and national security. The firm has also not said whether the password interception, the hash-and-token exposure and the suspected KYT account access involve the same attacker or the same method.

What the company does claim, repeatedly, is that it still has no evidence that investigation data (graphs, notes, cases), transaction or query results, or its attribution data were accessed or manipulated. That claim is Chainalysis's own; we have no independent way to verify it from outside.

Our view#

As XDRIP Digital Management LLC, we treat this as a reminder that the firms that screen and investigate on-chain activity are themselves high-value targets. When password hashes and session-style tokens leave a vendor's control, the risk is not only to that vendor's login page. Reused passwords, API keys wired into compliance workflows, and any token that can stand in for a password all extend the blast radius into customer systems. Chainalysis's own advice — reset credentials, rotate API keys, go to the login page directly rather than follow email links, and reset the same password elsewhere if it was reused — is the minimum customers should do.

The incident also shows how quickly an initial "limited profile data" disclosure can expand. Operators who rely on one analytics provider for monitoring should plan for outages and credential rotation before they are forced into it.

Open questions remain: the identity of the attacker, the scope of any unauthorised KYT use, when Reactor will return, and whether further data categories will be added to the disclosure. We will follow Chainalysis's updates.

Sources#

• Chainalysis, security incident page (updated 4 Nov 2026): https://www.chainalysis.com/blog/security-incident-october-30/
• The Record (Recorded Future News), 5 Nov 2026: https://therecord.media/chainalysis-all-users-hit-by-agentic-cyberattack
• crypto.news, 6 Nov 2026: https://crypto.news/chainalysis-confirms-user-credentials-exposed-in-cyberattack-takes-services-offline/