Chainalysis breach now exposes password hashes, tokens for all users

Blockchain-analysis firm Chainalysis has widened its breach disclosure. What began on October 30 as an exposure of identity metadata now covers, in the company's own words, "certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users." If you hold a Chainalysis login, you need to reset the password and rotate every API key once access is restored.

What changed

The first notice said attackers using "offensive agentic techniques" had viewed user IDs, names, email addresses and organizational roles, and that the impact was limited to non-sensitive identity data. Subsequent updates reversed that scope. Chainalysis now says an on-path (man-in-the-middle) attack exposed usernames and password hashes, and that live tokens for all users were also taken, as reported by The Hacker News and BleepingComputer.

The company says it has found no evidence that investigations data was accessed or that attribution data was manipulated.

What's offline

While investigating, Chainalysis pulled several services:

• The login portal.
• Reactor and Data Solutions.
• The Know-Your-Transaction (KYT) user interface and API.
• Address-screening products.

Impacted accounts were locked, so customers who received reset emails cannot currently reset passwords. Chainalysis says KYT and address screening will return first, and that every user must reset passwords and rotate API keys before resuming work.

Attribution

No group has claimed responsibility, and Chainalysis has not named an actor — it describes only a malicious actor using agentic tooling, and says the activity resembles attacks on "many other tech platforms in recent weeks." Treat the "AI-driven attack" framing with the usual caution: the mechanics disclosed so far — an on-path interception and credential exposure — are conventional, whatever tooling drove them.

Action checklist

1. Wait for Chainalysis to restore access, then reset your account password and rotate all API keys immediately.
2. Send trusted IP addresses to support@chainalysis.com or your account team for the allowlist that gates re-entry.
3. Rotate credentials reused elsewhere. Exposed password hashes are crackable offline; if staff reused a Chainalysis password on another system, change it there too.
4. Revoke and reissue any integration tokens that called the KYT API.
5. Watch for phishing that references the incident — "reset your Chainalysis password" lures are the obvious follow-on.

Context

This lands amid a run of credential-theft incidents the industry is loosely tagging "agentic": Chainstack, OpenCode, Warp and WorkOS have all disclosed similar activity in recent weeks, and both Microsoft and Google have reported credential abuse paired with LLM tooling. The label is doing a lot of work. What matters to defenders is unchanged: a vendor you trusted with analytics access has leaked hashes and live tokens for every user, and the clean-up is password resets and key rotation across your estate.