Chainalysis, the blockchain analytics firm whose tracing tools are used by police forces, tax authorities and crypto exchanges, has disclosed that a cyberattack exposed credentials belonging to every one of its users. In an update this week the company said it discovered on Monday, November 2 that customer information including names, usernames, password hashes and live tokens for all Chainalysis users had been exposed to a malicious actor.
The disclosure is a sharp escalation from the company’s first notice. When Chainalysis confirmed the intrusion on October 30, it said an external actor had used what it described as offensive agentic techniques, meaning AI agent assisted intrusion methods, to reach its systems and internal tools, and that the data accessed was limited to non-sensitive profile details such as user IDs, names, email addresses and organisation role labels, with no sign that authentication credentials or session tokens had been touched. A separate on-path attack, in which traffic between endpoints is intercepted, also exposed a subset of customer passwords; the company says that route has been found and closed.
Chainalysis took its login portal and several products offline after detecting abnormal activity, including the Reactor investigations tool, Data Solutions, the KYT transaction monitoring interface and API, and its address screening products. Customers are being required to reset passwords and rotate API keys before returning, with access restored through approved IP addresses. Live tokens matter because they are bearer credentials: whoever holds a still valid token is treated by the platform as the legitimate user, with no password needed.
The company says it has no evidence that investigation data was accessed or that its attribution data, the labels tying wallet addresses to real world entities, was manipulated, and it has not named the attacker or said how many accounts were improperly accessed. It also says the incident has no link to the 6.3 billion dollar Binance theft that the FBI attributed to North Korea. The hashing algorithm used for the exposed passwords has not been disclosed.