Chainalysis says a multi-stage cyberattack exposed names, usernames, password hashes and live tokens for every user of its platform. The blockchain analytics firm has taken core investigation and compliance tools offline in waves, started restoring Know Your Transaction screening in phases, and says it still has no evidence that investigation files or its attribution data were accessed or altered.
How the disclosure widened
Chainalysis first described the incident on October 30. In that notice, the company said an external actor used “offensive agentic techniques” to reach internal systems and tools, that some non-sensitive customer records such as user IDs, full names, email addresses and organization role labels had been accessed, and that it had found no evidence then of unauthorized access to investigation content, clear-text passwords, MFA secrets or session tokens. It also said the episode was not related to the recent theft at Binance.
By early November the picture had darkened. On Monday, according to a Wednesday night update, the firm discovered that names, usernames, password hashes and live tokens for all Chainalysis users had been exposed to a malicious actor. Separately that Wednesday morning, it told a subset of customers that an “on-path attack” had exposed their passwords, locked those accounts and required resets. Abnormal activity later the same day led Chainalysis to take its login page offline along with KYT, other address-screening products, Reactor and Data Solutions.
The company’s own timeline is published in its security incident blog, which it has updated through Friday. Independent coverage from BleepingComputer and Ars Technica matches that sequence: identity metadata first, then credential material for all users, then product outages while outside security firms helped harden systems.
What Chainalysis says was not taken
Across the updates, Chainalysis has repeated one limit on the damage claim. It says it continues to have no evidence that investigation content — graphs, notes, cases, transaction or query results — was accessed, or that Chainalysis attribution data was manipulated. That matters for customers that rely on the firm to label wallets tied to sanctions, ransomware and exchange hacks, because a corrupted attribution set would be a different kind of failure than a stolen login token.
The company has not named a threat actor, published a ransom demand or given a count of KYT accounts it believes were reached without authorization. It has said it is directly notifying customers whose KYT accounts appear to have been accessed without permission. Until those notices and a fuller forensic report appear, outside observers cannot tell how many production screening sessions were touched.
Products offline, then a phased return
Reactor and Data Solutions were pulled first, as a precaution while assessments ran. Compliance monitoring products stayed up longer because Chainalysis judged them critical for anti-money-laundering work, then came down after the firm spotted abnormal activity. On Friday, around 3:30 a.m. Eastern, Chainalysis said it had begun restoring access to KYT and Address Screening in phases, watching each stage before expanding the allowlist.
Customers who want back in are being told to send trusted IP addresses to support or their account team, then reset passwords and rotate API keys before registering transactions again. Reactor and Data Solutions remain offline while the firm finishes hardening work. The login path itself is no longer a normal public door; access is gated through that IP allowlist process.
The outage lands in a rough stretch for crypto security tooling and wallets. The same week saw Gnosis Pay disclose a breach of its legacy card system and Keplr pause social login after unauthorized transactions tied to a third-party auth provider. Chainalysis sits on the other side of that market — selling screening to exchanges, banks and law enforcement — which is why a credential dump across its entire user base draws unusual attention.
What customers should treat as settled
Three points are firm in the company’s own writing. All users should assume password hashes and live tokens were exposed and rotate credentials once access returns. Investigation-case content has not been shown to be in attacker hands, according to Chainalysis. And the firm still attributes the intrusion to agentic offensive tooling rather than to a supply-chain or exchange-hot-wallet style theft of customer crypto, which it explicitly separated from the Binance incident.
What remains open is the forensic close-out: which customer tenants saw unauthorized KYT use, how long live tokens stayed valid, and when Reactor comes back with the extra controls the firm has promised. Until that report lands, compliance teams that depended on Chainalysis as a single screening rail are the ones absorbing the operational cost.
FAQ
Were investigation graphs or attribution labels stolen?
Chainalysis says it has no evidence that investigation content was accessed or that its attribution data was manipulated. It has confirmed exposure of identity fields, password hashes and live tokens for all users.
How do customers regain access?
The firm is restoring KYT and Address Screening in phases. Customers must submit trusted IP addresses for an allowlist, then reset passwords and rotate API keys before registering transactions again.
Is this tied to the Binance hack?
Chainalysis said in its October 30 notice that the security incident is not related to the recent crypto theft involving Binance.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
