Chainalysis update: password hashes and live tokens for all users were exposed, and a subset of passwords was also taken
Chainalysis said on November 4, 2026 that it had discovered names, usernames, password hashes and live tokens for all its users were exposed to a malicious actor, reversing its October 30 statement that it had found no evidence authentication credentials or session tokens were accessed; a separate on-path attack exposed a subset of customer passwords, and every user must reset their password and rotate API keys as services are restored.
What happened
We first flagged this on October 30, 2026 — here’s what changed. Update Nov 6, 2026, 08:00 ET: Added Chainalysis’s November 4 disclosure that password hashes and live tokens for all users were exposed and that an on-path attack exposed a subset of customer passwords, the November 4 shutdown of KYT, address screening and the login page after abnormal activity, and the November 6 start of phased restoration. In its October 30 notice, Chainalysis said it had found no indication that passwords in clear text, multi-factor authentication secrets or user session tokens had been accessed. In an update timed 11:00 p.m. EST on November 4, the company reversed the credential part of that position: “On Monday, we discovered certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor.” Earlier on November 4, Chainalysis had emailed some customers that a separate “on-path attack” had exposed a subset of customer passwords; it said that attack vector has been contained and remediated, and it locked the affected accounts. The same day, after discovering abnormal activity, it took KYT (the user interface and API), other address screening products and the login page offline, and said it is directly notifying customers whose KYT accounts appear to have been accessed without authorisation. Reactor and Data Solutions had already been taken offline. In its November 6, 3:30 a.m. EST update, Chainalysis said it has begun restoring access to KYT and Address Screening in phases, and that all users will be required to reset their passwords and rotate API keys before registering transactions; Reactor and Data Solutions remain offline while work continues.
Who is affected
All Chainalysis users: the company says names, usernames, password hashes and live tokens for all users were exposed to a malicious actor. Within that group, a subset of customers had their passwords exposed in the on-path attack — Chainalysis emailed those customers directly on November 4 and locked their accounts as a precaution. A further group, customers whose KYT accounts appear to have been accessed without authorisation, is being notified directly. Chainalysis users sit at customer organisations — law enforcement, government agencies, exchanges and financial institutions — as set out in our original report. Chainalysis continues to say it has no evidence that investigations data has been accessed or that its attribution data has been manipulated.
How serious
The concrete risk is account takeover. Live tokens can be usable as signed-in sessions until they expire or are revoked; password hashes can be attacked offline and cracked, fastest where the password was weak or reused; and the subset of passwords exposed in the on-path attack needs no cracking at all. Combined with the real names, work emails and organisation role labels accessed in the original incident, the exposed material also makes precision phishing against the people who investigate cryptocurrency crime much easier — a fake password-reset or security email can now quote real account details. The part of the October 30 position that has not changed is the investigations-data statement: Chainalysis still reports no evidence that investigation content was accessed or attribution data manipulated.
What to do now
Reset your Chainalysis password by going directly to the Chainalysis login page yourself — the company’s own email warns against clicking links in password-reset emails — and rotate your API keys when your access is restored. Submit your organisation’s trusted IP addresses to Chainalysis for its allowlist, as the company requests, so your access can be restored. If you used the same password on any other service, reset it there too and choose a unique one — again the company’s own advice to the customers whose passwords were exposed. Keep two-factor authentication enabled, and treat unexpected password-reset requests and authentication prompts with extra suspicion: your name, role and now credential material are exactly what a convincing impersonation needs.
Sources: Chainalysis, “Security Incident Information” (updates October 30 – November 6, 2026) · CoinCentral, November 6, 2026 · Original report: Chainalysis breach (October 30, 2026)