Chainalysis: hashed passwords and tokens stolen for all of its customers

The facts below come from an Ars Technica article published on Friday 6 November 2026. That article is itself based on statements from Chainalysis. No independent second source could be consulted, so anything the company has not confirmed is reported as unverified.

An attack on several fronts

On Friday 30 October, Chainalysis announced that it had been hit by a cybersecurity incident in October. According to the company, the incident resembles attacks suffered by other platforms that same month. An external actor reportedly used offensive techniques assisted by AI agents to gain unauthorised access to its systems and internal tools. The first email sent to customers mentioned only “non-sensitive customer data”: user IDs, full names, email addresses and job titles within the organisation. Ars Technica questions whether that data can fairly be described as “non-sensitive”.

On Wednesday 4 November, the company disclosed something more. What it calls an “ongoing multifront cyberattack” also included an “on-path” attack, also known as “adversary-in-the-middle”. In this kind of attack, the attacker sits on a piece of infrastructure equipment that carries the traffic exchanged between two parties. This interception reportedly exposed some customer passwords. Chainalysis says it has identified and closed this entry point.

What was taken

The same Wednesday, the company set out what an investigation carried out on Monday 2 November had established. The names, usernames, password hashes and active tokens of all Chainalysis users were exposed to a malicious actor. A hash is the transformed form in which a password is stored. An active token is an access key that is still valid: it lets someone act on behalf of a user without having to enter their password.

According to the company and public sources, its customers include the FBI, US Immigration and Customs Enforcement (ICE), the US Air Force, as well as Microsoft, Coinbase and Barclays. It is not yet known whether the theft exposes these customers to further threats. Chainalysis says it has so far found no evidence that its investigation data was accessed, or that its attribution data was altered.

Services shut down, gradual return

After detecting “abnormal activity”, the company took its login page offline. It also shut down KYT (Know Your Transaction), its service that monitors threats to cryptocurrency holdings in real time, as well as access to its Reactor and Data Solutions services. On Friday 6 November, it began gradually restoring KYT and Address Screening for some of its customers, and said further services would follow.

If you are a customer, the known instructions are as follows:

• send Chainalysis the list of your trusted IP addresses, which will be added to an allowlist;
• be ready to reset your credentials as soon as access is restored;
• treat this credential change as mandatory, according to the company.

Because active tokens were stolen, any integrations and scripts that rely on Chainalysis access will logically need to be reconfigured with new secrets. As a precaution, if you used the same password on the platform and on another service, you should change it on that other service too.

The unanswered questions

Several points remain unclear. It is not known where the infrastructure compromised by the interception was located, nor whether the intercepted traffic was encrypted with TLS. Ars Technica points out that such interception is only useful if the attacker can decrypt what they observe. If that was the case, they could have gained broad control over the infrastructure.

Chainalysis has also not explained why it waited until Wednesday to announce that the data of all its customers had been exposed, a finding made two days earlier. It has given no details about the AI agents used or how they worked. A company representative said it would not comment beyond its blog post.

Until those answers arrive, customers have only one prudent assumption to work from: the attacker knows every secret tied to their account.