// AI threat desk · 15 Nov 2026
Home/AGENT · Agent Security
Agent SecurityMediumDATACVSS not assigned

Chainalysis cyberattack exposed data for all users and took products offline

Chainalysis said names, usernames, password hashes and live tokens for all users were exposed to a malicious actor, and it took several products offline.

· 2 min read
AI-generated image of security analysts investigating a cyberattack beside monitors showing blurred offline service panels.
AI-generated image, not a photo of the event.
Key takeaways
  • Names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor.
  • KYT, address screening products and the login page were taken offline after abnormal activity was found.
  • Chainalysis said it had no evidence that investigation data was accessed or attribution data was manipulated.

Chainalysis said it discovered on Monday that names, usernames, password hashes and live tokens for all users had been exposed to a malicious actor.

The company had taken KYT, its user interface and API, other address screening products and its login page offline after finding abnormal activity. Reactor, Data Solutions and Chain Beta also remained offline while Chainalysis completed critical work.

Chainalysis said it had no evidence that investigation data had been accessed or that its attribution data had been manipulated. 2-Spyware said the tools are used by exchanges and compliance teams to check whether payments come from risky wallets, while most users work at exchanges, banks, security firms and government agencies.

On this page

Chainalysis found an on-path attack and required an allowlist

Chainalysis said an external actor used offensive agentic techniques to gain unauthorized access to its systems and internal tools. The company initially described the exposed information as user IDs, full names, email addresses and organization role labels for users provisioned on its platform.

The company later confirmed that an on-path attack exposed a subset of customer passwords, including passwords belonging to recipients of its notice. Chainalysis said that attack vector had been contained and remediated.

Chainalysis customers span finance, government and cryptocurrency

The Record reported that Chainalysis says it provides services to more than 1,500 customers across law enforcement, cryptocurrency, finance, regulatory and national-security sectors.

The Record reported that Chainalysis said some customers’ accounts on its Know Your Transaction service appeared to have been accessed.

The Hacker News reported that Chainalysis added proactive monitoring systems to detect unusual activity.

Chainalysis said the on-path attack that exposed a subset of customer passwords had been contained and remediated. It also said it engaged third-party cybersecurity experts and was using large language models to review platform security and strengthen its defenses.

Chainalysis said users would have to reset passwords and rotate API keys, as applicable, before registering transactions once access was granted.

What to do now

  1. Reset your password and rotate API keys, as applicable, before registering transactions once access is granted.
  2. Be vigilant of unexpected password-reset requests or authentication prompts, and enable two-factor authentication.

FAQ

What happened in the Chainalysis cyberattack?

Chainalysis said an external actor used offensive agentic techniques to gain unauthorized access to its systems and internal tools. It later said names, usernames, password hashes and live tokens for all users were exposed.

Who was affected by the Chainalysis incident?

Chainalysis said the exposed information covered all users.

Were Chainalysis investigation records accessed?

Chainalysis said it had no evidence that investigation data had been accessed or its attribution data manipulated.

How should Chainalysis users secure their accounts?

Users must reset passwords and rotate API keys, as applicable, before registering transactions once access is granted. Chainalysis also recommended vigilance around unexpected password-reset requests and authentication prompts and enabling two-factor authentication.

Sources

  1. Updated Nov 6: Chainalysis Security Incident Information - Chainalysis, ChainalysisPrimary
  2. “Black October” for AI Developer Platforms | Wiz Blog, WizPrimary
  3. Chainalysis warns all users hit in cyber breach involving ‘agentic’ techniques, The Record
  4. Chainalysis Warns Customers After “Offensive Agentic” Security Incident, Infosecurity Magazine
  5. Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services, The Hacker News
  6. Chainalysis breach exposed logins of all its customers, 2-Spyware
  7. Chainalysis Breach Exposes Passwords and Tokens for All Users, Forcing Service Shutdowns, Chainalysis
How we checked this story
ClaimSourceStatus
Chainalysis said an external actor used offensive agentic techniques to gain unauthorized access to its systems and internal tools.ChainalysisConfirmed
Chainalysis said names, usernames, password hashes and live tokens for all users were exposed to a malicious actor on Monday.ChainalysisConfirmed
The company initially said some non-sensitive customer data, including user IDs, names, email addresses and role labels, had been accessed.ChainalysisConfirmed
Chainalysis said it had no evidence that investigation content or attribution data had been accessed or manipulated.ChainalysisConfirmed
Chainalysis said an on-path attack exposed a subset of customer passwords, and that attack vector had been contained and remediated.ChainalysisConfirmed
Chainalysis took KYT, address screening products and its login page offline after discovering abnormal activity.ChainalysisConfirmed
Reactor, Data Solutions and Chain Beta remained offline while Chainalysis completed critical work.ChainalysisConfirmed
Chainalysis said it engaged third-party cybersecurity experts and used large language models to review platform security.ChainalysisConfirmed
The Record reported that Chainalysis had more than 1,500 customers across law enforcement, cryptocurrency, finance, regulatory and national-security sectors.Chainalysis, via The RecordAttributed
The Hacker News reported that Chainalysis added proactive monitoring systems to detect unusual activity.Chainalysis, via The Hacker NewsAttributed
2-Spyware reported that exchanges and compliance teams use Chainalysis tools to check whether payments come from risky wallets.2-SpywareAttributed
2-Spyware reported that most Chainalysis users work at exchanges, banks, security firms and government agencies.2-SpywareAttributed
chainalysis.com published its report on Oct 30, 2026.chainalysis.comConfirmed
wiz.io published its report on Oct 30, 2026.wiz.ioConfirmed

Could not verify

  • Whether the exposed live tokens were used is not established
  • How many users or organizations were affected is not established
  • Whether the same attacker conducted the password interception, token exposure and suspected account access is not established
  • Whether the attacker used an AI agent in the Chainalysis intrusion is not established
data leak
See all in Agent Security →
Explore with AI
ChatGPT
Claude
Perplexity
Grok