Skip to content
NewA calmer, faster ZeroHour
StoryData breachhighExploited in the wild

Chainalysis breach later exposed credentials for all users

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Chainalysis now says an agentic attack exposed password hashes and live tokens for every user, with major services still offline.

Blockchain analytics firm Chainalysis first said an external actor used offensive agentic techniques in October to reach internal tools and access limited customer identity data. Later notices said names, usernames, password hashes and live tokens for all users were exposed, after an on-path attack amid a multi-front incident. The company says it has no evidence that investigation content, graphs or blockchain attribution were accessed or changed. It locked accounts, required password resets and API-key rotation, and took Reactor, KYT, address screening, Data Solutions and the login page offline while restoring access with extra controls. Chainalysis says the incident is unrelated to a recent Binance heist; the perpetrator is unidentified.

Key facts
  • Early notice: user IDs, names, emails and role labels only.
  • Later notice: password hashes and live tokens for all users.
  • No evidence investigations or attribution data were accessed.
  • Users must reset passwords and rotate API keys.
  • Reactor, KYT, address screening and login taken offline.
  • Chainalysis denies a link to a recent Binance heist.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 30, 2026Chainalysis initially disclosed the breach. · The Record
  2. Nov 2, 2026Company described limited identity-data access, no credentials. · SecurityWeek
  3. Nov 5, 2026Later finding: credentials and live tokens for all users. · The Record
  4. Nov 6, 2026Key products remain offline; trusted-IP restoration underway. · BleepingComputer

What each outlet adds

beyond the shared facts
  • SecurityWeekDenies link to a $6.36 billion Binance heist.
  • The RecordInitial disclosure was October 30; KYT accounts appeared accessed.
  • BleepingComputerAccounts locked; restore only from customer trusted IPs.
  • Ars TechnicaNames FBI, ICE, Air Force, Microsoft, Coinbase and Barclays.
  • The RegisterPassword reset down; KYT being restored; Reactor offline.
Vendors
Chainalysis
Products
ReactorData SolutionsKYTChainalysis platformAddress Screeninginternal tools
Victims
ChainalysisChainalysis usersFBIICEMicrosoftCoinbaseBarclaysChainalysis customers

Coverage

oldest first · one row per article · UTC
  1. · 7d ago GBHackersFirst report

    Chainalysis confirms cyberattack via offensive agentic AI techniques

    External actor gained unauthorized access to Chainalysis internal tools and customer data using AI-assisted methods.

  2. · 7d ago SecurityWeek

    Chainalysis discloses breach after AI-driven intrusion

    Accessed data was limited to user IDs, names, emails, and role labels; the victim count is undisclosed.