Chainalysis, the U.S. blockchain-analytics company whose tools exchanges, banks and investigators use to trace illicit cryptocurrency, now says names, usernames, password hashes and live tokens belonging to all of its users were exposed to a malicious actor, The Record reported Thursday. The disclosure reverses the company's first notice a week earlier, which said it had found no evidence that login credentials or session tokens were reached, and it shows how a supplier's early account of a breach can understate what its customers need to fix.
What Happened
Chainalysis first disclosed the incident Oct. 30, saying an outside actor had used "offensive agentic techniques" to get into internal systems and tools. That notice listed user IDs, names, email addresses and role labels among the data accessed and said the company had found no evidence that credentials or session tokens were reached, as The Primary Wire reported at the time. It also said the incident was unrelated to the theft at Binance, which The Primary Wire reported separately.
The company took its Reactor investigations tool and its Data Solutions product offline Monday as a precaution. In an email to customers, it said an "on-path attack," in which an attacker sits between users and a service and intercepts the traffic passing between them, had exposed a subset of customer passwords. It said that route was contained and the affected accounts were locked.
Shortly afterward, citing abnormal activity, Chainalysis took down KYT, short for Know Your Transaction, its service for flagging suspicious crypto transfers, along with other address-screening products and its login page.
Chainalysis said in an update late Wednesday that the data of all users had been exposed and that it was notifying customers whose KYT accounts appear to have been accessed without authorization. Every user must reset passwords and rotate API keys, the credentials that let customers' software connect to the service. The company planned to start restoring KYT and Address Screening Thursday for customers who supply trusted internet addresses for an allowlist, so only connections from those locations get through. Reactor and Data Solutions have no return date. Chainalysis said it had no evidence that investigations data was accessed or that its attribution data was manipulated.
What Is Still Unknown
The Record noted that Chainalysis has not explained what "live tokens" are, how passwords were hashed, or whether the intercepted passwords, the exposed hashes and tokens and the suspected account access involve the same attacker. It has not explained "offensive agentic techniques" or said that an AI agent carried out the intrusion, and the attacker has not been identified. A spokesperson told The Record the company could not share more than its blog post. Chainalysis says it serves more than 1,500 customers; it has not said how many users were affected.
Why It Matters
In under a week, the company's account moved from no evidence of credential access to credentials and tokens for all users. The Record pointed out that some password hashes can be cracked and that active tokens may allow access without a password, so the safer course is to act on the worst case: reset passwords, rotate keys, end sessions and change any reused passwords elsewhere. Chainalysis told users to go straight to its login page rather than follow links in reset emails, a guard against follow-on phishing.
The outage also hits compliance. Exchanges and financial firms use KYT to screen transfers for links to sanctioned or criminal addresses, and The Record said the company has not explained how customers were screening while it was down. Compliance teams need a documented fallback. Because the company's customers include law enforcement, regulators and national security agencies, its assurance about the integrity of its attribution data matters well beyond its own users.
What to Watch
Whether KYT and Address Screening return smoothly behind allowlists, and when Reactor and Data Solutions follow. Whether Chainalysis quantifies affected users, explains its "agentic" wording and links the separate fronts to one attacker, and whether it says it has informed regulators.
