Chainalysis says hackers took logins and tokens for all its customers

Chainalysis builds software that follows money on blockchains, the public ledgers behind coins like Bitcoin. Every transaction is visible, but the owners are only shown as strings of letters and numbers. The company links those addresses to real-world groups such as exchanges, scam rings and sanctioned networks.

Its customers include government agencies, banks, insurers and crypto firms around the world. Public sources name the FBI, US Immigration and Customs Enforcement, Microsoft, Coinbase and Barclays among them.

That customer list is why a breach here draws attention. The company's tools hold names of people who work on crime cases.

On Friday, October 30, Chainalysis told customers that an outside attacker had used "offensive agentic techniques" to get into its systems and internal tools. The break-in happened in October.

"Agentic" means AI agents, programs that can plan and act on their own. The company did not explain how the agents worked or which systems they touched.

At that point the company listed a small set of data: user IDs, full names, email addresses and organization role labels. It said it had found no sign that these things were reached:

• Investigation content: graphs, notes and cases.
• Passwords: no clear-text passwords.
• Login proof: no MFA secrets or session tokens.

MFA, or multi-factor authentication, is the second step, such as a phone code, that protects a login.

The picture changed over the next week. The company's updates show the steps:

• November 2: Chainalysis took Reactor and Data Solutions offline as a precaution. KYT and Address Screening stayed up.
• November 4, morning: it said an "on-path attack" had exposed a subset of customer passwords. It said the way in was found and fixed.
• November 4, later: it took the login page, KYT and Address Screening offline after it saw abnormal activity.
• November 4, evening: it said names, usernames, password hashes and live tokens for all users were exposed.

The update said the company found the full exposure on Monday, November 2. The company has not explained why it waited until Wednesday to say so.

An on-path attack is also called an adversary-in-the-middle attack. The attacker gets control of a machine that passes data between two sides. Think of a mail clerk who opens every envelope before sending it on.

Chainalysis has not said where on its network the attacker sat. It has also not said whether the traffic was protected by TLS, the encryption that scrambles data in transit. If it was not, the attacker could read it directly. If it was, the attacker would have needed more access to read it.

That gap is still an open question. If the attacker could read protected traffic, they may have had broad control of the company's systems.

Two of the stolen items are worth explaining, because they decide what customers must do.

A password hash is a scrambled copy of a password. Companies store hashes so they never keep the real password. A strong password is hard to recover from a hash. A weak or reused one can be guessed.

A live token is a digital pass. It tells a service that you already logged in, so you do not type your password again. If someone holds a working token, they may be able to act as you until it is cancelled.

In real life A password hash is like a blurry photo of your key. A live token is a hotel key card that still opens the door until the hotel switches it off.

That is why the company says every user must start fresh.

This is the part customers care about most. Chainalysis says that, so far, it has seen no evidence that investigation data was accessed. It also says it has no evidence that its attribution data, the labels that say who owns an address, was changed.

Those are claims from the company, and the investigation is still going. Chainalysis has said it is working with outside security experts. It also says it is using large language models, the AI systems behind chatbots, which means programs trained on huge amounts of text, to help review its platform.

Chainalysis set a clear route back in for customers:

• Send trusted IPs: customers email their trusted IP addresses, the network addresses their staff log in from, for an allow list. Only those addresses get in.
• Reset passwords: every user must pick a new password before signing in.
• Rotate API keys: an API key is a secret code that lets software talk to a service. Customers must replace theirs before they register transactions.
• Turn on two-factor login: the company has urged this since October 30.

Chainalysis also told customers to watch for unexpected password reset prompts and for scammers who pretend to be the company.

Yes, for now. On Friday, November 6, KYT and Address Screening began coming back in phases. KYT, short for "know your transaction", is a service that checks crypto payments for risk as they happen.

On Saturday, November 7, the company said Reactor, KYT (the interface and the API) and Address Screening are all back online with stronger security controls. Reactor is the tool investigators use to follow funds.

Customers get reconnection steps by email. The company has not said how many customers were affected, because it says the exposure covers all users.

Chainalysis said the incident has nothing to do with the record Binance theft at the end of October. The two events fell in the same weeks, and the company has been helping to trace the stolen Binance funds.

Another crypto security story from the same stretch: Ledger asked resellers in Asia to pull wallet products while it checks several hardware tampering reports. These are separate cases.

• If you are a Chainalysis customer: follow the email steps, reset your password and replace your API keys. Do not reuse the old password anywhere else.
• Watch your inbox: names, emails and job roles were taken, so fake messages can look real. Do not click a reset link you did not ask for.
• If you use any service with an old password: change it and turn on two-factor login. A stolen hash is easier to crack when the password is weak.
• If you are not a customer: nothing changes for you. Your crypto is not held by Chainalysis.