Security · November 11, 2026
Chainalysis confirms full user credential theft in recent breach
Chainalysis representatives disclosed that the recent security incident resulted in the theft of names, logins, password hashes, and active tokens for every user of the platform. This admission indicates that the consequences of the attack were significantly more severe than the company initially reported. The breach compromised the internal systems and tools of the blockchain analytics firm, leading to a widespread exposure of sensitive user data.
The company first detected the compromise of its internal systems in late October 2026. At that time, Chainalysis stated that attackers used offensive agentic techniques, which involved the use of artificial intelligence to automate the intrusion. The initial report indicated that the attackers gained access to user identifiers, names, email addresses, and organizational role information. The company originally described the stolen data as non-sensitive and asserted that user credentials and tokens were not affected during the attack. However, a subsequent investigation into the incident revealed that these initial assessments were incorrect.
Further analysis showed that the malicious actors conducted a man-in-the-middle attack, intercepting traffic between users and Chainalysis services. While researchers initially believed that only a portion of client passwords was compromised, the investigation found that the scale of the leak was much larger. The attackers successfully stole the names, logins, password hashes, and active tokens of all users. This comprehensive theft contradicts the earlier claim that credentials remained secure.
Chainalysis specializes in blockchain analytics and the tracking of cryptocurrency transactions. Its tools are frequently employed in investigations of fraud, extortion, and money laundering. The company serves a diverse client base that includes government agencies, law enforcement bodies, cryptocurrency exchanges, banks, and other major organizations. Notable clients and partners include the Federal Bureau of Investigation, the U.S. Immigration and Customs Enforcement, the U.S. Air Force, Microsoft, Coinbase, and Barclays. Some of the company's products are used directly in law enforcement investigations.
The company's Reactor platform assists in analyzing cryptocurrency movement and linking transactions to specific services and addresses. Chainalysis experts emphasized that they have not found evidence of unauthorized access to investigation materials or interference with the blockchain address attribution system. When it became clear that some password hashes had been stolen, the company blocked the affected client accounts. Later, upon noticing new suspicious activity, Chainalysis temporarily blocked access to several services for all clients, including the login page, Reactor, Data Solutions, the KYT monitoring service, and blockchain address verification tools.
Access to these services is currently being gradually restored. Clients are asked to provide trusted IP addresses to be added to an allowlist. All users will be required to change their passwords and, if necessary, their API keys after regaining access. Several important details of the attack remain unknown. The company has not explained which part of its infrastructure was compromised to allow the man-in-the-middle attack, nor whether the attackers could decrypt the intercepted traffic. The role of the artificial intelligence agents in the breach also remains undisclosed. The identity of the attackers is currently unknown, though the incident resembles other attacks on technology platforms in recent weeks.