Chainalysis Says Attackers Got Password Hashes and Live Tokens for Every User

Chainalysis spent a week telling customers the damage was small. Then it wasn't.

In an updated incident notice this week, the blockchain analytics firm said names, usernames, password hashes and live authentication tokens for all of its users were exposed to an attacker. WuBlockchain flagged the update on X on Nov. 6 and added the part that stings most: some plaintext passwords leaked too, through a separate attack method.

From "non-sensitive" to everything

Chainalysis went public on Oct. 30. Its security incident post said an outside actor had used "offensive agentic techniques" to get into its systems and internal tools. At that point the exposed data was user IDs, full names, email addresses and organization role labels. The company called it non-sensitive and said it had found no sign of access to investigation content, credentials or session tokens. It also said, twice, that the incident had nothing to do with the Binance theft.

Five days later that picture fell apart. Chainalysis said it discovered on Monday, Nov. 2 that the wider set of data had been exposed, and Cointelegraph reported that the firm first described the change on Wednesday. A separate update said an "on-path attack," the man-in-the-middle kind, had exposed a subset of customer passwords, according to BleepingComputer. The company says that vector is now contained.

One date doesn't line up. Cybernews puts the discovery on Wednesday, Nov. 4. Chainalysis's own wording, as quoted by Cointelegraph and BleepingComputer, says Monday.

What a live token means

Password hashes are scrambled, not readable, but they can be cracked, and any user who reused a password is exposed elsewhere. Live tokens are the bigger worry. As American Banker explained, a token lets a person or program act as a logged-in user without typing a password. Chainalysis hasn't said what an intruder could see or change with one. It also declined to give Cointelegraph anything beyond the published notice, and it hasn't said whether the attacker has been kicked out.

The Shutdown

First to go dark were Reactor, the investigations tool, and Data Solutions, which feeds Chainalysis data into customers' own systems. Later, after spotting abnormal activity, the company pulled KYT, both the interface and the API, along with address screening and the login page, per The Hacker News. Affected accounts were locked. For some users even a password reset wasn't possible yet.

Restoring access means an IP allowlist, a password reset and API key rotation for every user. KYT and address screening were first in line. Reactor and Data Solutions have no return date.

For a compliance team that screens deposits through KYT, that's an ugly week. Customers include law enforcement, government agencies, banks, insurers and crypto businesses, BleepingComputer notes. Several of them had a core screening tool disappear while they waited for answers.

The line that matters most

Chainalysis keeps saying it has no evidence that investigation data was accessed or that its attribution data was manipulated. Attribution data is the thing that ties addresses to real entities, and if someone could quietly edit it, every trace built on it becomes suspect. So the claim carries a lot of weight.

I'd still read it carefully. "No evidence" was also the company's position on credentials and tokens on Oct. 30. American Banker pointed out that the broader disclosures came five days after that statement. That doesn't make the current claim false. It does mean the investigation is still moving.

The AI angle

Chainalysis says it's seeing an industry-wide rise in AI-driven attacks. It hasn't said which tool was used, how long the attacker was inside, or which vulnerabilities were exploited. Teiss noted it's unclear whether the attacker used a framework like ARTEX or custom agents.

The wider pattern is real, though. The Hacker News lists Chainstack, OpenCode, Warp and WorkOS among companies that have reported AI-driven attacks recently. Microsoft described one campaign where an agent went from scanning GitHub for exposed secrets to pulling data out of Azure Key Vault in about five minutes. Nothing public ties that campaign to Chainalysis.

A bad week for crypto security

The timing is awkward. Binance lost roughly $6.3 billion in an Oct. 29 breach, and Chainalysis was among the firms helping the community work out who was behind it. This week Binance and Deribit also revoked all API keys tied to the trading platform SignalPlus after it reported a security issue. SignalPlus later said a fake Microsoft Teams invite compromised an engineer's machine and put losses below $82,000. Binance and Deribit both said their own systems weren't affected, and Changpeng Zhao urged traders to revoke SignalPlus keys on other exchanges.

None of these incidents is linked to Chainalysis. Together they show how much of this industry's security now runs through logins, tokens and API keys held by third parties.

What Users Should Do?

Chainalysis customers should expect a forced reset and rotate any API keys the company asks about. If you reused your Chainalysis password anywhere else, change it there. Treat any unexpected password reset email or authentication prompt as hostile, which is exactly what Chainalysis told its own users to do.

Still unanswered: how many customers had accounts accessed, whether the attacker is out, and when Reactor comes back.