INCIDENT HUB · DEVELOPING STORY
Chainalysis — incident hub
The Chainalysis breach and its follow-up: customer names, emails and role labels accessed first — then password hashes and live tokens for all users exposed.
Latest: Chainalysis update: password hashes and live tokens for all users were exposed, and a subset of passwords was also taken (disclosed 2026-11-04)
Timeline — every report
CONFIRMEDChainalysis platform usersDISCLOSED NOV 4
Chainalysis said on November 4, 2026 that it had discovered names, usernames, password hashes and live tokens for all its users were exposed to a malicious actor, reversing its October 30 statement that it had found no evidence authentication credentials or session tokens were accessed; a separate on-path attack exposed a subset of customer passwords, and every user must reset their password and rotate API keys as services are restored — follow-up to our October 30 report.
CONFIRMEDChainalysis platform usersDISCLOSED OCT 30
Chainalysis said an external actor using what it calls ‘offensive agentic techniques’ gained unauthorised access to its systems and internal tools in October, and accessed user IDs, full names, email addresses and organisation role labels for platform users; it says investigation content, clear-text passwords, MFA secrets and session tokens were not accessed.
← All breach reports