Chainalysis Breach Exposed All Users' Tokens

Chainalysis, the blockchain analytics company used to trace cryptocurrency crime, said names, usernames, password hashes and live tokens for all of its users were exposed to an attacker in a breach it links to "offensive agentic techniques." The company said Saturday, Nov. 7, that its Reactor, KYT and Address Screening products were back online with added security.

Key takeaways

• The first notice on Oct. 30 reported no evidence of access to credentials or session tokens. On Nov. 4, Chainalysis said live tokens for all users had been exposed.
• Every user must reset passwords and rotate API keys as applicable. Chainalysis says it has no evidence that investigations data was accessed or attribution data manipulated.
• The company has not named the attacker or described the AI agents used.

How the Chainalysis breach widened

Chainalysis keeps a running log on its security incident page. Its first entry said an external actor had used offensive agentic techniques to reach systems and internal tools, and that user IDs, full names, email addresses and organization role labels were accessed.

What Chainalysis customers need to do

Chainalysis asked customers to send trusted IP addresses for an allowlist, then reset passwords and rotate API keys before registering transactions. On Nov. 7 it said customers would get emailed instructions to reconnect "in a specific way."

The company also told users to go directly to its login page rather than click links in password-reset emails, and to change the password on any other service where it was reused.

What remains unexplained

Ars Technica reported that the source of the on-path attack is unknown, that Chainalysis did not explain the two-day gap between discovery and disclosure, and that it gave no details on the AI agents. A representative told the outlet the company was not commenting beyond its blog.

The Nov. 7 update does not mention Data Solutions or Chain (Beta), which were listed as offline on Nov. 4.

Context: AI agents in real-world intrusions

BleepingComputer reports that Chainalysis customers include law enforcement, government agencies and financial institutions. Chainalysis said the incident was "similar to many other tech platforms in recent weeks" and unrelated to the recent crypto theft at Binance.

Wiz said Oct. 29 that it increasingly sees intrusions where AI agents appear to handle much of the hands-on work. Microsoft reported Oct. 21 that Storm-0940, a China-aligned actor, used the ARTEX framework and in several cases went from initial targeting to privileged cloud access in under three hours. Neither report addresses Chainalysis, and no public link between those campaigns and this breach has been established.

What's next

Chainalysis says its investigation continues with outside experts and that it is using large language models in a broader security review. Customers are still waiting for a root-cause account, including how the on-path attack worked and what the agents did.

FAQ

Were Chainalysis investigation files stolen?

The company says it has no evidence that investigations data was accessed or that attribution data was manipulated. Its investigation is ongoing.

Do Chainalysis users need to act?

Yes. All users must reset passwords and rotate API keys as applicable, and should follow the emailed reconnection instructions.

References

• Updated Nov 7: Chainalysis Security Incident Information — Chainalysis (Nov. 7, 2026)
• AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise — Microsoft Security Blog (Oct. 21, 2026)
• The Rise of Agentic Attacks: What They Look Like, and Where They're Headed — Wiz (Oct. 29, 2026)
• Chainalysis says hackers stole credentials and tokens for all of its customers — Ars Technica (Nov. 6, 2026)
• Chainalysis says breach exposed credentials for all customers — BleepingComputer (Nov. 6, 2026)