Chainalysis: Every User's Login Data Was Exposed, the Firm Now Says, and Its Screening Tools Went Offline

On Wednesday 4 November 2026, at 11:00 p.m. US Eastern time, Chainalysis added a paragraph to its company blog that was much bigger than the notice it had published five days earlier. "Certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor," the company said. A firm whose software helps police forces and exchanges follow stolen digital money was telling its own customers that every one of them had been affected by a break-in.

No theft of crypto has been reported, and Chainalysis has not said that any customer lost money. This story covers what changed since the first notice. The first notice is told in full in Chainalysis: The Firm That Tracks Crypto Hackers Says an Attacker Using AI Agents Got Into Its Systems, which CMZ published on 31 October.

Why this firm matters to people who never touch crypto

Chainalysis reads blockchains, the public ledgers where crypto payments are recorded. Every payment is visible, but the parties show up only as long strings of characters, like a share register that lists account numbers and no names. Chainalysis sells software that labels those strings, saying which belong to exchanges, scammers or sanctioned groups, and draws the route of the money as a map.

The Record, a cybersecurity news outlet, reported that the company serves more than 1,500 customers, among them law enforcement, national security bodies, crypto businesses and regulated finance. Two products matter here. Reactor is the investigation tool that follows funds from one wallet to the next, a wallet being the digital account that holds coins. KYT, short for "know your transaction", is a screening service that exchanges run on deposits and withdrawals. It is the crypto version of the anti-money-laundering check a bank runs on a transfer. If the screening stops, an exchange has to find another way to check who it is dealing with, or pause. The Record noted that Chainalysis did not say how customers are screening transactions while KYT is down.

What changed between 30 October and 4 November

On 30 October, Chainalysis said an outside actor using "offensive agentic techniques" had reached its systems. It listed user IDs, full names, email addresses and role labels as accessed, and said it had found no sign that passwords in clear text or session tokens were reached. "Agentic" is the tech industry's word for AI agents, software that picks its own next steps. The phrase is the company's own. Chainalysis has not explained it or said an AI agent carried out the attack.

On Monday 2 November, according to the blog, Chainalysis took Reactor and Data Solutions offline for outside security assessments, while its compliance monitoring products stayed up.

On Wednesday 4 November the blog shows a run of entries. The company said an "on-path attack" had exposed a subset of customer passwords, and that it was contained. An on-path attack is one where someone sits between a user and a service and reads what passes between them, like a person quietly opening and resealing letters in a sorting office. Affected accounts were locked. Later that day Chainalysis said that, after monitoring turned up "abnormal activity", it took KYT, its other address screening products and the login page offline. The Record reported this happened about 40 minutes after a customer email that called the attack an "ongoing multifront cyberattack". The email did not name the other fronts.

Then came the 11:00 p.m. update. Chainalysis said customers whose KYT accounts appear to have been accessed without authorisation are being contacted directly. The blog does not explain why the 30 October statement, which found no sign of session tokens, gave way to a statement that live tokens for all users were exposed.

What the terms mean

A password hash is a scrambled version of a password. A service stores the scramble instead of the password, so a thief who copies hashes does not get passwords directly. Weak passwords can still sometimes be worked out by guessing at scale, which is why resets matter. A token is a digital pass that keeps a person signed in, and a "live" one is presumably still valid. The Record said Chainalysis did not explain what its live tokens could open. An API key is the password software uses to connect to a service automatically.

What Chainalysis says it is doing

Chainalysis says it has "no evidence" that investigations data was accessed or that its attribution data, the labels saying which addresses belong to whom, was manipulated. It has engaged outside cybersecurity experts. It said it intended to begin restoring KYT and Address Screening on Thursday 5 November, with customers first sending it trusted internet addresses for an approved list. After that every user must reset their password and replace their API keys. Users were told to go to the login page directly instead of using links in password-reset emails. The Record reported no restoration date for Reactor, Data Solutions or Chain (Beta).

What is still unknown

Chainalysis has not given a number of users or organisations. It has not named the attacker, said how the attacker got in, or said whether the password interception, the token exposure and the KYT account access were the work of the same party or methods, a gap The Record pointed out. A company spokesperson told The Record it could share nothing beyond the blog post. Chainalysis has also said the incident is unrelated to the Binance theft, and nothing published links the two.

Status check

Checked at about 16:40 UTC on 5 November 2026 (11:40 a.m. US Eastern): the newest entry on Chainalysis's blog post was still the 4 November 11:00 p.m. update. The company's own status page listed KYT, Address Screening and Reactor as under maintenance, and said it was "continuing our work to bring all systems back to operational".