Chainalysis Widens Breach Disclosure: Password Hashes, Live Tokens Exposed

Chainalysis just made a bad week worse. In a late-evening update on November 4, the blockchain analytics firm told customers that names, usernames, password hashes and live tokens tied to all of its users had been exposed to a malicious actor — a sharply wider set of data than it first described. The original October 30 statement had called the accessed material non-sensitive: user IDs, full names, emails and organizational role labels.

That first account also said there was no evidence clear-text passwords, multi-factor authentication secrets, session tokens or investigation content had been touched. The follow-ups walked that back in part. Chainalysis now says password hashes and live tokens were exposed for its entire user base, and that a separate on-path attack — where an attacker intercepts traffic between a user and a service — leaked plaintext passwords for a subset of customers. The company says that vector has been contained and remediated.

The cleanup came with a cost to uptime. While investigating, Chainalysis pulled access to Reactor and Data Solutions. After spotting abnormal activity, it took the Know Your Transaction tool — both the user interface and the API — offline, along with other address-screening products and the login page. Customers whose KYT accounts look like they were accessed without authorization are being notified directly.

Affected accounts were locked and hit with mandatory password resets. Chainalysis said it planned to start restoring access to KYT and Address Screening the next day, and asked customers to reach out with trusted IP addresses so they could be placed on an allowlist. Once back in, users will have to reset passwords and rotate API keys as needed to register transactions.

The firm says it is still working with outside cybersecurity experts and has been leaning on large language models as part of its security review and system-hardening push. Despite the broader credential exposure, it repeated that investigators have so far found no sign that investigation content — graphs, notes or cases — was accessed, or that its attribution data was tampered with. Chainalysis has not said which hashing algorithms were used, what the live tokens can actually do, how many users or organizations are affected, or how the attacker pulled it off beyond the references to offensive agentic techniques and the on-path attack.

The stakes are high because of who Chainalysis serves: banks, crypto businesses, and law-enforcement and national-security agencies that lean on its transaction-monitoring tools. Exposed identities, org roles, password hashes and live tokens open the door to account takeover, credential-stuffing attacks — especially where passwords are reused — and targeted phishing, even if the company's current assessment that deeper investigation data is safe holds up. Customers and partners are being told to watch for odd password-reset requests or authentication prompts and to switch on multi-factor authentication where they can.