Blockchain analytics company Chainalysis has confirmed that names, usernames, password hashes and valid authentication tokens for all users were exposed during a cyberattack, significantly widening the scope of its previously disclosed security incident.
In an update published late November 4, 2026, Chainalysis reversed its October 30 assessment that credentials and session tokens remained unaffected. The company said some customer passwords were also exposed through an on-path attack, which intercepts communications between users and online services. The intrusion involved offensive agentic techniques, though the specific tools and extent of AI involvement remain undisclosed.
The company initially reported on October 30 that an attacker accessed internal systems and tools, exposing user IDs, names, email addresses and organizational roles. The expanded investigation later revealed the compromise included password hashes and live authentication tokens. Unlike plaintext passwords, password hashes are cryptographic representations, but weaker passwords may still be recoverable offline. Live tokens can allow account access without requiring users to re-enter passwords.
Following the breach, Chainalysis suspended Reactor and Data Solutions on November 2. On November 4, after detecting abnormal activity, it took Know Your Transaction (KYT), including its user interface and API, offline, along with other address-screening products and its login page. The company said some KYT customer accounts appeared to have been accessed without authorization and would be contacted directly.
Restoration of KYT and Address Screening was set to begin November 5 through an allowlisting process using trusted customer IP addresses. All users must reset passwords, and API keys will be rotated where appropriate. Chainalysis said it had found no evidence that confidential investigation records were accessed or that blockchain attribution data had been manipulated. External cybersecurity specialists have been engaged to investigate the intrusion.
Chainalysis serves more than 1,500 institutional customers globally, including exchanges, financial institutions and government agencies. The incident highlights security risks facing cryptocurrency compliance providers. Chainalysis said the breach is unrelated to the separate Binance theft and described it as an ongoing multifront cyberattack.
