Chainalysis Says Live Tokens for All Users Were Exposed in Its Breach

Chainalysis told customers late on Nov 4 that names, usernames, password hashes and live authentication tokens belonging to all of its users had been exposed to an attacker, a broader disclosure than the company made when it first confirmed the breach on Oct 30. Two days later, its own status page still lists nine of eleven product components as under maintenance, including the KYT transaction-monitoring interface and API that compliance teams use to screen payments as they settle.

The revised incident notice is the fourth substantive update to a single support page in six days. It states that the exposure covers “names, usernames, password hashes and live tokens for all Chainalysis users,” that the company is “directly notifying customers whose KYT accounts appear to have been accessed without authorization,” and that it intends to restore the monitoring tools only after customers supply trusted IP addresses for an allowlist.

For the banks, exchanges, payment firms and investigators that route screening and casework through Chainalysis, the practical damage is not a stolen password. It is the gap between the compliance function they have outsourced and the manual process they now have to run in its place, with no published date for when the software comes back.

A status page that has been degraded for four days

The company status page carried a “Partially Degraded Service” banner at 06:58 UTC on Nov 6, and the incident it has tracked since 15:50 UTC on Nov 2 remained classified as “investigating.” Nine components sit under maintenance: Crypto Compliance, KYT API, KYT UI, Reactor, Address Screening, Crypto Investigations, Investigations API, Rapid Lookup and Sentinel. Hexagate and the Crypto Security and Fraud group are listed as degraded rather than offline, which leaves two of eleven components reporting normal service.

The downtime is now measurable in days rather than hours. Reactor and Data Solutions were pulled on Nov 2, which puts the investigation tooling at more than 87 hours offline at the time of that check. KYT went down at 10:30 a.m. EST on Nov 4, roughly 15:30 UTC, so the monitoring interface had been unavailable for about 40 hours when the status page was last read.

That matters because the Nov 4 notice set a timetable the company has not met. “We intend to begin restoring access to KYT and Address Screening tomorrow,” it said, written at 11:00 p.m. EST on Nov 4. The following morning’s target has passed, and the most recent status update, posted at 06:41 UTC on Nov 6, says only that teams are “continuing our work to bring all systems back to operational.” No new date appears on either page.

The sentence that reversed the Oct 30 statement

The first disclosure was narrow on the question that mattered most. Chainalysis said on Oct 30 that it had found no evidence of unauthorized access to “authentication credentials, or session tokens,” language that told customers their logins and API keys were probably intact. The Nov 4 update withdraws that assurance without saying so directly: live tokens and password hashes for all users, in the company’s own words, were exposed.

Live tokens are the more consequential half of that pair. A password hash has to be cracked before it is useful, and the company’s guidance to reuse-check other services implies it expects customers to treat the hashes as compromised. A valid session or API token does not need cracking. It authenticates against the product directly, which is why the restoration plan requires every user to reset passwords and rotate API keys before transactions can be registered again.

The notice also separates two attack paths that are easy to conflate. The “on-path attack” is described as having exposed “a subset of customer passwords,” and the company says that vector “has been contained and remediated.” The token and hash exposure is described separately and without a scope limit, attached to the phrase “all Chainalysis users.” Chainalysis has not published a user count, so the size of the affected population remains unknown from its own material.

Why a monitoring outage is a compliance event

Chainalysis framed the risk itself in the Nov 2 update, when it decided to keep KYT running while taking other products offline. It cited “the importance of our compliance transaction monitoring products to our customers’ businesses, particularly their role in detecting money laundering across the ecosystem.” That sentence is the company acknowledging that KYT is not an analytics convenience but part of how regulated firms discharge monitoring duties.

When the tool goes dark, the obligation does not. A bank or licensed exchange that screens payments through KYT has to either pause the activity it would normally monitor, route the flow through a competing provider, or accept the risk in writing and backfill the checks once access returns. Those choices are made customer by customer and jurisdiction by jurisdiction, and none of them is described in the Chainalysis notice, which directs affected firms to their account team and an IP allowlist instead.

The allowlist step is worth reading closely. Access will be granted to named IP ranges first, then users reset passwords and rotate API keys “to register transactions.” That is a staged return rather than a switch-on, and it means the first customers back will be those with fixed infrastructure, not the long tail of smaller firms that connect from changing addresses.

Investigation data and the attribution question

The company has been consistent on one point across every update: it says it has found no evidence that investigations data was accessed or that its attribution data was manipulated. That claim covers the product Chainalysis sells to law enforcement and to exchanges building enforcement cases, and it is the claim most likely to be tested later, because attribution labels feed into seizures, sanctions designations and court filings.

An attacker holding valid tokens for every user has a path that does not require touching the underlying database: query the platform as a legitimate customer and read what it returns. Chainalysis says it is notifying the customers whose KYT accounts appear to have been accessed without authorization, which implies the company has identified at least some unauthorized sessions. It has not said how many, what those sessions queried, or whether the review covered Reactor and the investigations products that went offline on Nov 2.

The wider context is a bad month for the vendors that crypto firms rely on to detect bad activity. BlockchainReporter reported that hackers took more than $6 billion from Binance in late October, and Chainalysis moved quickly to state that its own incident “is not related to the recent crypto theft at Binance.” Separately, the firm’s own research has tied the $387 million Bitget hack to North Korea, work that depends on the integrity of the attribution data now under review.

Chainalysis attributes part of the pattern to automation, saying it is seeing “an industry-wide rise in AI-driven cyberattacks.” That is the company’s characterization of its own incident, not an independently verified finding, and no technical account of the intrusion has been published.

What the notice leaves unanswered

Four questions are open, and each one changes how a customer should behave this week. The first is the restoration date: the only forward-looking statement, “tomorrow,” referred to Nov 5 and has expired. The second is scope, because “all Chainalysis users” has no number attached and the company has not said whether the exposure includes free-tier accounts, trial users or only paying customers.

The third is the KYT access review. Telling some customers their accounts “appear to have been accessed without authorization” without saying how that was determined leaves every other customer unable to judge whether their own queries were read. The fourth is whether the third-party forensics work that the company says it is conducting alongside outside experts will be published in any form. The Oct 30 notice promised updates as work progressed; the Nov 4 update promised to “communicate these changes as necessary.”

For now the defensible reading is narrow. Chainalysis has confirmed a credential exposure that reaches every user, has kept its monitoring and investigation products offline for days, and has missed the one restoration date it published. What it has not confirmed is any unauthorized access to the data those products hold, and that distinction is the difference between a credential incident and a disclosure of investigative work.

Frequently Asked Questions

Data: Chainalysis incident notice, Chainalysis status page. Status readings and downtime figures were taken at 06:58 UTC on Nov 6, 2026.