Chainalysis Breach Exposes Live Tokens: What Customers Must Do Now

On 30 October 2026 Chainalysis told customers it had found no evidence that authentication credentials or session tokens were reached. Five days later, on 4 November, the same page said names, usernames, password hashes and live tokens for all users were exposed.⁠¹ As of the 7 November 1:50 PM EST update, Reactor, KYT and Address Screening are back online. The page still does not define live tokens, name an attacker or count the accounts accessed, and some coverage adds details the page does not contain.⁠¹

30 October: a notice that listed what was not taken

On 30 October, Chainalysis posted a notice and the text of an email to customers. DOCUMENTED: it said an external actor used "offensive agentic techniques" to gain unauthorized access to systems and internal tools. It said there was no indication that investigation content, transaction or query results, clear-text passwords, MFA secrets or user session tokens had been accessed.⁠¹ It said non-sensitive data was accessed: user IDs, full names, email addresses and organization role labels.⁠¹

CLAIMED, by Chainalysis: the incident was unrelated to the recent Binance crypto theft and resembled incidents at other tech platforms in recent weeks. No source reviewed here independently addresses either point.⁠¹ The email said some customers had been notified earlier and gave the timing only as this month. It told users to watch for unexpected password reset requests and to turn on two-factor authentication if it was off.⁠¹ The page never states when the intrusion began or was detected.⁠¹

On 30 October the accessed list held four items, none of them credentials.

Timeline, 30 October to 7 November

Every row but one rests on the page, which Chainalysis edits in place under the same address.

4 November: the same page, with different words

Reported At 11:00 PM EST on 4 November, Chainalysis said it had discovered on Monday that names, usernames, password hashes and live tokens for all users were exposed to a malicious actor. It said it still had no evidence that investigations data was accessed or attribution data manipulated.⁠¹ The 30 October line on credentials used the same kind of phrasing and lasted five days. Read no evidence as no evidence yet, not as no access.

The word changed from user session tokens to live tokens. DOCUMENTED: Chainalysis has not said whether the two are the same thing.⁠¹ The Record reported that the company did not explain what live tokens are or how the passwords were hashed. It added that some hashes can be cracked, while active tokens can let an attacker in without a password.⁠³

The 4 November update says the exposure was discovered on Monday. The Monday update on the same page does not mention it. Chainalysis did not explain the two-day interval, according to Ars Technica as relayed by Northeast Times; the Ars original was blocked here.⁠¹⁠⁴

A spokesperson told reporters the blog post was all the company could share.⁠³

What Chainalysis says about the attacker, and what the record supports

CLAIMED, by Chainalysis: an external actor used agentic techniques. The Record reported that the company has not explained the phrase, did not explicitly say an AI agent caused the breach, and has not identified the perpetrator.⁠³ BleepingComputer's extract says attackers used AI tools.⁠⁵ Ars, as relayed, says AI agent-assisted techniques.⁠⁴ Both go a step past the company's wording. No technical basis has been published, so any link to AI tooling remains a company claim.

DOCUMENTED: the 4 November 9:50 AM email says an on-path attack exposed a subset of customer passwords and that the vector was contained.⁠¹ The Record described it as an attacker intercepting communications between users and a service.⁠³ Ars, as relayed, reported that Chainalysis has not said where the infrastructure compromise occurred or whether the intercepted data was TLS encrypted.⁠⁴

BleepingComputer's extract ties the on-path attack to the exposure of usernames and password hashes for all customers.⁠⁵ The page makes no such link. The Record noted that Chainalysis has not said whether the password interception, the hash and token exposure and the suspected KYT account access involved the same attacker or methods.⁠³ Opinion The Record tracks the page more closely, and BleepingComputer was reachable here only as a search extract, so this article follows The Record.

UNVERIFIED: some coverage says plaintext passwords leaked for some customers through a different attack method. KuCoin News, relaying ME News, and Hokanews, citing Wu Blockchain, carry the claim, and neither points to a Chainalysis sentence.⁠⁶⁠⁷ The 4 November email says a subset of passwords was exposed and does not say whether they were hashed or in clear text. The 30 October email said there was no indication of clear-text access.⁠¹

No definition of live tokens, no user count, no named attacker

• Token type. Chainalysis has not said what a live token is. It decides whether a password reset alone closes the exposure.
• Hashing method. Not stated. It decides how quickly hashes can be cracked and how much a reused password matters elsewhere.⁠³
• Scope. The statement did not specify whether every category was exposed for every user, and it gave no user count.⁠³ All users may mean each category for each person, or each category for some.
• Start date. The page says this month and gives no start or detection date.⁠¹
• Data Solutions and Chain (Beta). The 7 November update names neither. The last status for Data Solutions was offline on 6 November, and for Chain (Beta) offline on 4 November.⁠¹
• Screening during the outage. The Record reported that Chainalysis did not say how customers were screening transactions while KYT was offline.⁠³

What to do now, service by service

DOCUMENTED, Chainalysis guidance: send trusted IP addresses to support or your account team for the allowlist. Once access is granted, every user resets their password and rotates API keys as applicable before registering transactions. Go straight to the login page rather than links in reset emails. Reset reused passwords elsewhere. Follow the reconnect instructions in the email Chainalysis began sending on 7 November.⁠¹

Chainalysis published no per-product list. This table applies its general instructions to each product.

Opinion As applicable is undefined. Because Chainalysis has not said which tokens were exposed, rotate every Chainalysis API key your organization holds, not only the KYT one. For KYT users, rotation is required before registering transactions anyway.

Worked example: the 4 November 10:30 AM update has KYT's interface and API already offline, and the 7 November 1:50 PM update restores them. That is at least about three days and three hours. Opinion Compliance teams should record that window themselves, since Chainalysis has not said how transactions were screened during it.⁠¹⁠³

If you received the 4 November 9:50 AM email, treat that password as known to the attacker, in whatever form. Reset it everywhere it was reused.

What to check next: the update stamp and three open items

Check the page's updated line, not the headline. The address still says October 30, and the last edit was 7 November. Save a dated copy each time you read it, because earlier wording is overwritten.⁠¹ Three items would change the guidance: a definition of live tokens, a status for Data Solutions and Chain (Beta), and any revision to the no-evidence statements on investigation and attribution data.