Chainalysis Says Names, Password Hashes and Live Tokens for All Users Were Exposed, Pulls KYT and Reactor Offline

Chainalysis told customers late Wednesday night, Nov. 4, that its breach is worse than it first said. Names, usernames, password hashes and live tokens for ALL of its users were exposed to a malicious actor.

The company sells blockchain tracing tools to exchanges, banks, regulators and police. Its website says it serves more than 1,500 customers across law enforcement, crypto, traditional finance and national security.

From "no evidence" to all users

The timeline matters here. On Oct. 30, Chainalysis disclosed that an external actor had used "offensive agentic techniques" to get unauthorized access to its systems and internal tools. It said then that exposed data included user IDs, email addresses, full names and organizational roles, and that it had found no evidence of compromised authentication credentials or session tokens.

On Nov. 2, the company took Reactor, its investigation platform, and Data Solutions offline for additional security assessments. Its compliance monitoring products kept running at that point.

In an update on Nov. 4, it said an "on-path attack" had exposed a subset of customer passwords. An on-path attack intercepts communications between a user and a service. Chainalysis said it had contained and remediated that attack method, notified affected customers by email and locked their accounts. The email described an "ongoing multifront cyberattack."

Then came the late-night update. Chainalysis said that after adding monitoring, it spotted abnormal activity in its transaction screening systems. It said it is "directly notifying customers whose KYT accounts appear to have been accessed without authorization."

What went offline

The Know Your Transaction user interface and API, the address screening products and the login page are all down. So are Reactor, Data Solutions and the Chain (Beta) service.

KYT is the tool exchanges and financial firms use to score the risk of incoming and outgoing crypto transfers and flag suspicious ones. Chainalysis said it is working "around the clock to harden our systems and bring Reactor and Data Solutions back online."

The company said it planned to start restoring KYT and Address Screening on Thursday, Nov. 5. Customers must send trusted IP addresses to support@chainalysis.com or their account team to be added to an allowlist. After that, users can reset passwords and rotate API keys.

Chainalysis said every user will have to reset passwords and rotate API keys as appropriate. It also said that for customers who just received a reset email, resetting is not possible right now because accounts are locked. It urged people to change reused credentials on other systems and to go to its login page directly instead of clicking links in reset emails.

What Chainalysis has not said

The company says it still has no evidence that any investigations data was accessed or that its attribution data, the labels identifying who owns which crypto addresses, was manipulated. That is a statement of what it has found so far, and the investigation is ongoing.

Several basics are undisclosed. Chainalysis has not said how the passwords were hashed. Some hashes can be cracked to recover the original password, so the method determines the risk. It has not defined "live tokens," though active authentication tokens can let an attacker into an account without a password. It has not said whether every data category was exposed for every user, or how many users it has. It has not explained what "offensive agentic techniques" means, and it has not identified who is behind the attack.

Chainalysis said earlier that the breach came amid an industry-wide rise in AI-driven cyberattacks. It did not explicitly say an AI agent caused its own breach. It also said the incident is unrelated to the recent Binance cryptocurrency theft. The company has hired outside cybersecurity specialists, and large language models are being used to support its internal security review.

Other companies hit

Chainalysis described the attack as similar to those on "many other tech platforms in recent weeks." Chainstack, OpenCode, Warp and WorkOS have disclosed AI-driven attacks, some involving an autonomous penetration testing tool called ARTEX.

Microsoft has said threat actors are using an agentic AI offensive framework to scan public GitHub repositories for exposed secrets, including credentials and AI inference API keys, to launch follow-on attacks. Nobody has publicly tied the Chainalysis intrusion to ARTEX or that framework.

The practical problem for customers

A screening outage is its own risk, separate from the data exposure. An exchange that cannot run KYT checks has a gap in its transaction reviews even if no records were altered. Security analysts at eSecurity Planet advise compliance teams to document which checks were unavailable, review affected transfers once service returns, and verify restoration on Chainalysis's status page instead of assuming the schedule held.

Chainalysis's disclosure has widened with each update since Oct. 30. The open questions now are whether KYT and Address Screening actually came back on Nov. 5 as planned, when Reactor and Data Solutions return, and what the company's direct notices to KYT customers show about who got into those accounts and what they did there.