🔍 Read the full analysis: Chainalysis Breach: A Timeline Of Updates On User Password Hashes And Live Tokens on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Chainalysis said on Nov. 4 that names, usernames, password hashes and live tokens for all its users had been exposed to an attacker, revising an Oct. 30 statement that said there was no evidence credentials or session tokens were accessed. The company took several services offline, began restoring some on Nov. 6 and required customers to reset passwords and rotate applicable API keys. The hash algorithm, meaning of “live tokens,” number of affected accounts and attacker’s identity remain undisclosed.
Chainalysis said on Nov. 4 that an attacker had accessed names, usernames, password hashes and live tokens for all Chainalysis users, revising an initial public statement that said there was no evidence credentials or session tokens had been accessed. The blockchain analytics company took several products offline during its response; as of its Nov. 6 update, KYT and Address Screening were returning in phases, while other services were still being restored.
In its first public update, dated Oct. 30, Chainalysis said an external actor had accessed user IDs, full names, email addresses and organization role labels. The company described those details as “non-sensitive customer data” and said it had found “no evidence” of unauthorized access to investigation content, authentication credentials or session tokens.
The account changed in updates posted on Nov. 4. At 9:50 a.m. Eastern, an email to certain customers described an “ongoing multifront cyberattack” and an “on-path attack” that had exposed a subset of customer passwords. Chainalysis said that route had been contained and remediated, locked the affected accounts and asked those users to reset their passwords. About 40 minutes later, it took KYT, address-screening products and the login page offline after what it called “abnormal activity.”
At 11 p.m. Eastern that day, Chainalysis said it had discovered on Nov. 2 that names, usernames, password hashes and live tokens for all users were exposed to a malicious actor. The company said it was directly notifying customers whose KYT accounts appeared to have been accessed without authorization. On Nov. 6, it began bringing KYT and Address Screening back in phases, requiring customers to provide trusted IP addresses for an allowlist. Its update said all users would need to reset passwords and rotate API keys, where applicable, before registering transactions.
Infographic 01 · How the story changed
From “non-sensitive data” to every user’s password hash
Every dated entry in Chainalysis’ own incident post, in order. The highlighted entry reverses the first one.
From “no evidence of unauthorized access to authentication credentials or session tokens” (30 Oct) to “password hashes and live tokens for all Chainalysis users” (4 Nov).
The disclosure, in numbers
Chainalysis incident post, US Eastern time
- 6 dated updates in one post, 30 Oct to 6 Nov 2026
- 2 days between Monday’s discovery and Wednesday night’s disclosure
- 40 minutes between the on-path email (9:50 AM) and KYT going offline (10:30 AM)
- 1,500+ customers in 70+ countries, by the company’s own count
- OctoberBreach detected“an external actor using offensive agentic techniques” in Chainalysis systems and internal tools
- Fri 30 OctFirst notice (~5:14 PM)User IDs, full names, emails, role labels accessed. “No evidence” of access to credentials or session tokens
- Mon 2 NovReactor + Data Solutions offline“Out of an abundance of caution”. All-users exposure discovered this day, disclosed later
- Wed 4 Nov, 9:50 AMOn-path attack“A subset of customer passwords” exposed; accounts locked, reset required
- Wed 4 Nov, 10:30 AMKYT + login page offline“Abnormal activity”; password reset “won’t be possible right now”
- Wed 4 Nov, 11:00 PMAll users“Names, usernames, password hashes and live tokens for all Chainalysis users were exposed”
- Fri 6 Nov, 3:30 AMPhased restoreKYT + Address Screening behind an IP allowlist; every user resets passwords and rotates API keys
Sources: Chainalysis incident post, 30 Oct to 6 Nov 2026 · Chainalysis company page · BleepingComputer, 31 Oct 2026 (time of the first post). No attribution: no attacker has been named.
Powered by Thorsten Meyer AI
Why Exposed Tokens Matter
The revised disclosure changes the practical risk for customers. The initial update described identifying and organizational details; the later one included password hashes and live tokens. Chainalysis has not explained what its use of “live tokens” covers, so readers cannot determine from the disclosure what access those tokens might permit. Password hashes are not the same as plaintext passwords, but their exposure still makes the undisclosed hash algorithm and other security details relevant to evaluating risk.
Customers use Chainalysis products for blockchain investigations and transaction screening. Service outages can interrupt those workflows, while the company’s Nov. 6 instructions require account-security steps before customers can resume some activity. Names, email addresses and role labels can also make a phishing message appear tailored to a recipient. That is a risk consideration, not confirmation that attackers have used the data for phishing.
The gap between the two public accounts matters for customers deciding how to respond. Chainalysis first reported no evidence of credential or session-token access, then disclosed exposure of password hashes and live tokens. The company’s later statement does not, by itself, establish that every exposed credential can be used to log in or that every account was accessed. It does call for users to follow the company’s reset and key-rotation instructions rather than rely on the earlier assessment.
Popular right now
KitchenAid 5.5-Qt Bowl-Lift Stand Mixer, Porcelain White (KSM55SXXX)
Breville BES870XL Barista Express Espresso Machine
KitchenAid Classic Series 4.5-Quart Tilt-Head Stand Mixer, Onyx Black
As an affiliate, we earn on qualifying purchases.
Five Days of Revised Disclosures
Chainalysis maintains an incident post with dated updates. The timeline described in that post, as reproduced in the source material, starts with an intrusion detected sometime in October; the company has not given a specific date for the initial access. Its Oct. 30 post was the first public account. On Nov. 2, it took Reactor and Data Solutions offline, citing ongoing cyber threats and saying the action was taken “out of an abundance of caution.” It kept compliance transaction-monitoring products running, citing their role in detecting money laundering.
On Nov. 4, the company’s customer messages progressed from a warning about a subset of passwords to a broader disclosure covering hashes and live tokens for all users. Those statements appeared within the same day, but the broader exposure had, according to Chainalysis, been discovered on Nov. 2. Chainalysis has not explained why the public disclosure of that finding came on Nov. 4. Its later update said Reactor and Data Solutions were still being restored.
Chainalysis describes itself as serving government agencies, exchanges, financial institutions and cybersecurity companies in more than 70 countries, and says it has over 1,500 customers. Those are company figures. The reported service interruption therefore involves software used by organizations working across investigations and compliance, though the incident updates do not establish how many customers’ operations were disrupted.
Key Technical Details Remain Unknown
Chainalysis has not publicly specified the password-hashing algorithm, what it means by “live tokens,” or how many individual users or accounts were affected. Its statement that data for all users was exposed does not say how many accounts were accessed or whether every exposed item could be used to gain access. The company has said certain KYT accounts appear to have been accessed without authorization, but has not provided a count in the source material.
The attacker’s identity and motive have not been disclosed. Chainalysis used the phrase “offensive agentic techniques” to describe the intrusion, but has not explained what techniques that phrase refers to. It also has not provided a full public account of how the initial access occurred, why the Oct. 30 assessment changed, or what information supports the revised assessment. The source material reports no attribution of the attack to a named person or group.
Restoration and Customer Security Steps
Chainalysis said KYT and Address Screening would return in phases, with customers first supplying trusted IP addresses for an allowlist. Reactor and Data Solutions were still being restored in the Nov. 6 update. The company had not given a completion date for those services in the information available here.
Customers should follow account instructions through login pages and support channels they already know, rather than links in unsolicited messages. Chainalysis’s stated steps are to reset passwords and rotate applicable API keys; anyone who reused an exposed password should change it on other services as well. Customers should also check official company updates for service status and account-specific instructions. Further details on the exposed tokens, hash protections, affected accounts and investigation may change the assessment as Chainalysis releases more information.
Key Questions
What information did Chainalysis say was exposed?
In its Nov. 4 update, Chainalysis said names, usernames, password hashes and live tokens for all users were exposed to a malicious actor. Its Oct. 30 post had listed user IDs, full names, email addresses and organization role labels, while saying there was no evidence credentials or session tokens were accessed.
Were all Chainalysis accounts accessed?
The company said information for all users was exposed, but it did not say that every account was accessed. It said certain KYT accounts appeared to have been accessed without authorization and did not provide a count in the source material.
Which Chainalysis services were taken offline?
Reactor and Data Solutions were taken offline on Nov. 2. On Nov. 4, Chainalysis also took KYT, address-screening products and its login page offline after reporting abnormal activity. KYT and Address Screening began returning in phases on Nov. 6; Reactor and Data Solutions were still being restored.
What should Chainalysis customers do?
Chainalysis said users would need to reset passwords and rotate API keys, where applicable, before registering transactions. Customers should follow instructions through trusted company channels, change reused passwords elsewhere and be cautious of targeted messages. The company has not disclosed what “live tokens” means or the hash algorithm used.
Source: ThorstenMeyerAI.com
