Chainalysis says agentic attack exposed credentials for all users

Chainalysis said on Oct. 30 that an outside actor using offensive agentic techniques had accessed its internal systems and tools without authorization, and on Nov. 4 it reversed its earlier position by disclosing that account names, usernames, password hashes and active tokens for every user had been exposed.

On Friday, October 30th, Chainalysis discovered it had been targeted by an external actor using offensive agentic techniques. On Oct. 30, Chainalysis said an outside attacker had accessed its internal systems and tools without authorization. It withdrew its earlier assurance that credentials and session tokens were unaffected when it published an update on November 4, 2026.

Chainalysis shared the update on Nov. 4 at 11 p.m. ET and said it learned of the exposure on Monday. FinanceFeeds reported that a later investigation showed the compromise reached live authentication tokens and password hashes. Cybernews reported that at that point, there was no evidence that investigation content had been accessed without authorization.

When it first disclosed the incident, Chainalysis said the exposed information covered user IDs, names, email addresses and organizational roles. Some customer passwords were exposed through an on-path attack, a method that intercepts communications between people using online services. Active authentication tokens can allow account access without requiring users to enter passwords again. Someone who cracks certain password hashes can learn the original password.

Chainalysis stated it has no evidence that investigations data was accessed or that attribution data was manipulated. It said some Know Your Transaction customer accounts appear to have been accessed without authorization and noted that affected customers were being contacted directly. Chainalysis has not identified the attackers and has not established whether compromised credentials were exploited beyond the suspicious activity already found. The company has not disclosed how many users or organizations were affected.

Chainalysis says more than 1,500 institutional customers worldwide rely on its services across law enforcement, cryptocurrency and traditional finance, as well as regulators and national security bodies. More than 70 countries receive Chainalysis data, software and analysis for cybersecurity firms, financial institutions, exchanges and government agencies. People using Chainalysis usually work in compliance and anti-money-laundering departments at law enforcement agencies, banks and crypto exchanges.

The company offers transaction monitoring, compliance services and blockchain investigation to government agencies, financial institutions and cryptocurrency exchanges. Exposed names, work email addresses and job functions could support targeted phishing aimed at workers who review suspicious payments and enter sensitive tools.

Chainalysis removed access to Reactor and Data Solutions while investigating. On Monday as a precaution, Chainalysis took offline its Reactor investigations tool and Data Solutions product, and it temporarily suspended them on Nov. 2. Because of abnormal activity on Nov. 4, Chainalysis disabled its Know Your Transaction user interface and API, other address screening products and the Chainalysis login page.

The Chain (Beta) service was taken offline as well. The company has not said when Reactor, Data Solutions or Chain (Beta) will be restored. Compliance transaction-monitoring products remained online and received close monitoring for unusual activity. Chainalysis locked impacted accounts as a precaution.

Chainalysis intends to start restoring Know Your Transaction and Address Screening access on Nov. 5 using an allowlisting process that requires trusted customer IP addresses, saying the services would be restored on Thursday after customers sent trusted IP addresses to be allowlisted. Customers must submit trusted IP addresses to support personnel or their account team. After an address is added to the allowlist, customers can reset credentials and rotate API keys.

Chainalysis brought in outside cybersecurity specialists to investigate the intrusion and strengthen its infrastructure. Its own systems are being reviewed using large language models. Chainalysis also added proactive monitoring systems designed to detect unusual activity. Chainalysis said it is working around the clock to harden systems and restore Reactor and Data Solutions.

Chainalysis said users who reused passwords should change their credentials on other platforms. It also recommended two-factor authentication for organizations that have not enabled it.

Chainalysis asked customers to inform their security teams about unusual messages or account activity. Chainalysis urged affected customers to visit its login page directly instead of clicking links in password-reset e-mails. Customers who received a password-reset email cannot reset their password right now.