Chainalysis breach: password hashes and live tokens for all users exposed after an “agentic” attack

The Chainalysis breach is an intrusion that the blockchain analytics company disclosed on October 30, 2026, then widened on November 4. It now acknowledges that the names, usernames, password hashes and live tokens of all its users were exposed to a malicious actor, according to Cointelegraph. Chainalysis cites “offensive agentic techniques” and says it has no evidence that investigation data was accessed.

The initial notice was much more reassuring than the update. Here is the timeline, what is established, what remains unknown and what customers should do.

What happened in the Chainalysis breach?

Chainalysis detected in October that an external actor had accessed its systems and internal tools, then published its first disclosure on October 30, according to Breached.company. It reported the exposure of user IDs, names, email addresses and organization roles, with no evidence of access to authentication credentials or session tokens, as BleepingComputer reported.

On the evening of November 4, the company revised that assessment. According to Cointelegraph, it discovered on Monday (November 2) that the names, usernames, password hashes and live tokens of all users had been exposed, and a separate “on-path attack” had exposed some customers’ passwords.

Chainalysis breach: which data is exposed?

According to the update relayed by Cointelegraph, the names, usernames, password hashes and live tokens of all users are affected. Chainalysis has not specified the hashing algorithm used, nor what the tokens could access, as The Register notes.

The company says it has no evidence that the investigation data in Reactor, its investigation tool, was accessed, or that attribution data was manipulated. It has not given the number of users or customers affected, nor the attacker’s identity.

Products taken offline, then restored

According to The Register, several services were pulled, including the Reactor platform, Data Solutions and the KYT interface, and Chainalysis planned to restore KYT and Address Screening on November 5. To reconnect these services, customers must first supply trusted IP addresses for an allowlist, then reset their passwords and rotate API keys if needed.

Tech Insider, the only source we found for the detail, says Reactor, KYT and Address Screening were back online on November 7, while Data Solutions and Chain (Beta) remained offline with no return date. That site says itself it did not verify these items against Chainalysis’s incident page, so treat this status as provisional.

• Date of the first disclosure: October 30 for Breached.company and The Register, an article dated October 31 at BleepingComputer, which reports the previous day’s publication.
• Discovery of the widened exposure: Monday, November 2 according to Cointelegraph, which suggests a two-day delay before Wednesday’s announcement.
• Scope: four data fields at first, then all users with password hashes and live tokens.
• Products: the list of those offline varies from one source to another.

An “agentic” attack: what should we make of it?

By “offensive agentic techniques”, Chainalysis apparently means operations driven by AI agents. The Register notes that the company compared the attack to others that hit other tech platforms “in recent weeks”, without being able to verify this. Breached.company adds that neither the software framework nor the model used is publicly described.

For its part, WorkOS said the attacker used ARTEX, according to a BleepingComputer article cited by Privacy Guides, but no source we consulted links ARTEX to the Chainalysis incident. Chainalysis also says the incident has nothing to do with the roughly $6.36 billion Binance theft, and Breached.company mentions a separate incident at Allium announced on October 28.

Our analysis: a disclosure that worsened in five days

This section is our analysis. The notable point is the gap between the first announcement, which spoke of “non-sensitive” data, and the second, which acknowledges hashes and live tokens for all users. A live token can let someone act as an account without knowing the password, until it is revoked. We do not know whether the tokens have been revoked, and Cointelegraph notes that this point is not addressed.

For a company whose customers (exchanges, agencies, investigators) handle sensitive data, the main risk is targeted social engineering, with fake fund-recovery or recruitment offers. Chainalysis in fact warns its customers about such impersonations, according to BleepingComputer. We saw a similar case in our article on the Mixpanel data breach tied to OpenAI, where a vendor exposes its customers’ data.

What to do if you are a Chainalysis customer

Treat every account in your organization as potentially compromised, even if Chainalysis has not yet confirmed the detail for you. Here are the steps to take:

1. Ask Chainalysis whether your users are affected and demand the per-organization breakdown the company promises.
2. Supply your trusted IP addresses for the allowlist, then reset all passwords and rotate API keys.
3. Revoke active sessions and tokens on platform accounts, and review recent activity.
4. Change passwords you reused elsewhere, as Chainalysis recommends, and follow our guide to creating a secure password.
5. Enable two-factor authentication and be wary of emails or messages claiming to come from Chainalysis, especially those offering fund recovery or recruitment.

Frequently asked questions about the Chainalysis breach