Short answer
Chainalysis disclosed a security incident on 30 October 2026, attributing it to an actor using 'offensive agentic techniques'. It first said only non-sensitive identity data was exposed, then said on 4 November that usernames, password hashes and live tokens for all users were affected. It has no evidence that investigations data was accessed.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Chainalysis |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Blockchain analytics and compliance software |
| Country | United States |
| Detected | 2026-10-30 |
| Disclosed | 2026-10-30 |
| People or records affected | All Chainalysis users, per the company's 4 November update |
What data was exposed
- Names, usernames and email addresses
- User IDs and organization role labels
- Password hashes and live tokens for all users (company update of 4 November)
What happened
Chainalysis, a firm whose software traces cryptocurrency flows for law enforcement, exchanges and banks, published a security notice on 30 October 2026. It said an outside actor had accessed some internal systems using “offensive agentic techniques”, and that it had hired outside experts and was using large language models to review its own defenses. It said the incident was unrelated to the Binance theft.
How the picture changed
The first notice described the data as non-sensitive: user IDs, full names, email addresses and organization role labels. It said there was no evidence of access to investigation content, clear-text passwords or session tokens.
On 2 November the company took its Reactor and Data Solutions products offline as a precaution. On 4 November it said a subset of customer passwords had been exposed through an “on-path attack” that it described as contained. Later that day it widened the statement: names, usernames, password hashes and live tokens for all users were exposed. BleepingComputer and The Register both noted that this sits uneasily with the earlier claim about tokens, and Chainalysis has not explained the difference.
The Register added that the company has not said which hashing algorithm protects the passwords.
What is offline and what is back
Chainalysis took the login page, KYT (user interface and API) and address screening products offline on 4 November, with Reactor and Data Solutions also down. In its update at 3:30 a.m. on 6 November it said KYT and Address Screening were returning in phases, and that Reactor and Data Solutions remain offline while they are hardened with outside experts.
Customers must supply trusted IP addresses for allowlisting. Once granted access, every user has to reset their password and rotate API keys, and should not register transactions before doing so.
Who is at risk
Chainalysis customers include government agencies, crypto exchanges, financial institutions and security firms. Staff names, email addresses and role labels make good material for targeted phishing, because a message can be written to look like internal compliance traffic. That is a risk that outlasts any password reset.
The company has not named an attacker. No stolen investigation files have been reported, and Chainalysis says it found no evidence of that.
What to do
If you use Chainalysis, follow the company’s reset and API key steps, change any reused password and enable two-factor authentication. Be careful with reset emails: the company says to use its login page directly. For the general steps after a credentials leak, see our data breach checklist and our guide to phishing messages. For crypto fallout from the week, see our post on the Binance hack.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake password reset emails that copy the real ones. Chainalysis tells users to go directly to its login page and not to click links in reset emails.
- Targeted phishing of compliance and investigations staff using their real names and role labels.
- Misuse of stolen password hashes or tokens against reused passwords on other services.
What to do if you are affected
- 01Reset your Chainalysis password and rotate API keys once access is restored, as the company requires before you register transactions.
- 02Send your organization's trusted IP addresses to Chainalysis support so they can be allowlisted.
- 03Change the same password anywhere else you used it, and turn on two-factor authentication.
- 04Do not click links in password reset emails. Type the Chainalysis login address yourself.
- 05Brief your team that attackers know staff names and roles, and treat unexpected authentication prompts as suspicious.
Frequently asked questions
What did Chainalysis say was exposed?
On 30 October it said user IDs, full names, email addresses and organization role labels. Its 4 November update said names, usernames, password hashes and live tokens for all users were exposed.
Was investigations data accessed?
Chainalysis says it has no evidence that investigations data was accessed or that its blockchain attribution data was manipulated. It says KYT accounts that appear to have been accessed without authorization are being notified directly.
Did the company change its account of the incident?
Yes. The 30 October notice said no evidence of session token access. The 4 November update said live tokens were exposed. The company has not explicitly reconciled the two statements.
Who was behind it?
Chainalysis has not named anyone. It describes an actor using 'offensive agentic techniques' and later called it an on-path attack. It says the incident is unrelated to the Binance theft.
Sources
- Updated Nov 4: Chainalysis Security Incident Information (latest update Nov 6), Chainalysis, 2026-11-06
- Chainalysis says breach exposed credentials for all customers, BleepingComputer, 2026-11-06
- Blockchain investigator Chainalysis hit by cybersecurity incident, Cointelegraph, 2026-10-31
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.