Chainalysis Data Breach Exposes All Users’ Live Tokens

Chainalysis said on 6 November 2026 that the data breach it is still investigating exposed names, usernames, password hashes and live tokens for all of its users, and it took KYT, Reactor and its login page offline. Exchanges, banks and government agencies use these tools for financial-crime work, so the incident is now a vendor-credential problem their own security teams have to manage.

What did Chainalysis confirm in the data breach?

Chainalysis confirmed that four categories of data were exposed for every user: names, usernames, password hashes and live tokens. The company said “all users.” That wording sets this disclosure apart from the usual SaaS breach notice, which speaks of “a subset of customers” and leaves every tenant guessing.

The statement came out of the company’s investigation into what it calls an “ongoing multi-front cyber attack.” Note the word ongoing. Chainalysis has not said the intrusion is contained. It has said that specific vectors have been addressed and that it has added monitoring.

This is the second disclosure in less than a week. In the first, Chainalysis said an external actor had used “offensive agentic techniques” to gain unauthorized access to its systems and internal tools, which we covered in our earlier report on AI agents reaching Chainalysis internal tools.

That first statement also described an “on-path attack” that exposed “a subset of customer passwords,” a vector Chainalysis says “has since been addressed.” On-path is the current term for adversary-in-the-middle, the technique behind phishing kits that relay a login to the real site and capture the session cookie. Chainalysis has not said that is what happened here.

The 6 November statement widens the scope from a subset of passwords to all users, and from passwords alone to names, usernames, hashes and live tokens. That is a wider exposure, not proof of a single escalating attack. Whether it came through the on-path position, the internal-tools access or a third route, Chainalysis has not said.

Nor has it attributed the attack. It compared the activity to attacks on “many other tech platforms in recent weeks” and named no actor, group or tool. The timing invites a link to the ARTEX campaigns Microsoft has documented, but Chainalysis has not drawn it and no one has published evidence for it.

Which Chainalysis products are offline, and what was not touched?

Reactor, Data Solutions, the Know Your Transaction (KYT) user interface and API, the other address-screening products and the login page were all taken offline. “While we investigated, we removed access to Reactor and Data Solutions,” the company said. Impacted accounts were also locked, and users who got reset emails were told a Chainalysis password reset “won’t be possible right now.”

Chainalysis also says: “At this time we continue to have no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated.” Read that as you would an interim finding in your own incident report. Partway through an open investigation, “no evidence” means the logs reviewed so far show nothing. It is not proof that nothing happened.

The distinction matters more for Chainalysis than for most vendors. Its attribution data, the labels that tie blockchain addresses to entities, feeds sanctions screening and law enforcement cases. Quietly altered labels could make a sanctioned wallet look clean or a clean one look dirty.

Nothing Chainalysis has said suggests that happened. Customers whose compliance decisions rest on that data should still ask their account team, in writing, which logs back the claim and how far back they go.

For operations teams the immediate effect is simple: any transaction-monitoring pipeline that calls the KYT API is either failing or running on a fallback.

Why do live tokens matter more than password hashes?

An attacker can replay a live token without cracking anything. A password hash is a delay whose length depends on the hashing algorithm and the strength of the password, and Chainalysis has disclosed neither. A live session or API token is a working credential: whoever holds it acts as the user until the server revokes it.

Hence the recovery plan. If hashes were the only problem, forced resets would cover most of the risk. With live tokens in the set, Chainalysis has to invalidate existing sessions and keys and also restrict where new authentication can come from. The IP allowlist does that job. It is blunt, but a surviving token replayed from an unlisted address should fail.

The hashes still create a downstream problem. Any user who reused their Chainalysis password elsewhere now has it sitting in someone’s offline cracking queue. Chainalysis’s own advice says as much: “We still encourage you, where necessary, to reset your password on other systems where you may be reusing credentials.”

How is Chainalysis restoring KYT and Address Screening?

Chainalysis is restoring access in stages, starting with KYT and Address Screening, and only for customers who have registered trusted IP addresses. The process:

1. Send your trusted IP addresses to support@chainalysis.com or to your account team for allowlisting.
2. Once allowlisted, reset passwords for every user.
3. Rotate API keys before you register transactions again.

Every account will have to reset passwords and rotate API keys “as appropriate,” and the company says it has added “additional proactive monitoring systems” to detect unusual activity. Reactor and Data Solutions come later, once Chainalysis finishes what it calls “working around the clock to harden our systems.”

Watch for two traps. First, a manual allowlist process run over email is a ready-made phishing pretext. Expect messages asking you to “confirm your IP for Chainalysis access” from addresses that are not Chainalysis’s. Reach support only through channels you already have on file.

Second, rotating a key is not the same as revoking it. Many SaaS platforms keep old and new API keys valid side by side during a grace period. After you rotate, test the old key and confirm it fails.

Where does the Chainalysis breach sit next to ARTEX and stolen LLM access?

The Chainalysis breach comes amid a wave of AI-driven intrusions against developer and infrastructure platforms. Chainstack, OpenCode, Warp and WorkOS disclosed attacks in the same weeks, some involving an autonomous penetration-testing tool called ARTEX. No one has tied Chainalysis to ARTEX with evidence.

Microsoft says the ARTEX-linked activity has been ongoing since August 2026. Agents scan public GitHub repositories for user credentials, application credentials and AI inference API keys, analyze the results and launch follow-on attacks with little hands-on-keyboard work from the operator. In one case an agent went from a GitHub secret to Azure Key Vault exfiltration in five minutes.

From there, agents signed in as service principals with valid application credentials, which Microsoft says succeeded “on dozens of associated applications across multiple tenants.” They targeted Azure operations that return credentials, such as storage account keys, connection strings and AKS user credentials, then reached SharePoint, OneDrive and mailbox items. Single-tenant OAuth apps served as pivots for further enumeration.

API keys for major AI providers and OAuth apps with access to Foundry Tools (formerly Azure Cognitive Services) were a stated priority. None of this path touches a human password, so user MFA does not stop it. Service principal hygiene does, and it sits at the core of an Entra ID security assessment.

Stolen AI keys have a market. Google describes “LLM mixers,” intermediaries who sell access to compromised enterprise LLM accounts and proxy requests across many stolen accounts to spread usage and hide its origin. Wiz found two resale operations running on stolen AWS Bedrock keys from two organizations, with no evidence the site operators carried out the original compromises.

Victims, Wiz says, have run up hundreds of thousands of dollars in AI API charges. Wiz also reports that an IP address tied to one resale site hosted an ARTEX landing page in mid-October 2026 and was flagged by Zeabur as an indicator of compromise. That is an infrastructure overlap, not attribution.

Zeabur offers a precedent for plaintext secrets. In October it disclosed that an unknown actor had exploited credentials stored in plaintext and taken more than 3.2 million environment variable records plus data tied to 321,810 accounts.

What should Chainalysis customers check now?

Treat this as a vendor credential compromise inside your own environment:

• Inventory every integration. List every system holding a Chainalysis API key: transaction-monitoring services, CI variables, secrets managers, analyst laptops. Rotate each key, then confirm the old one is rejected.
• Hunt for reuse. Compare Chainalysis user lists against your identity provider. Any analyst who reused that password on SSO, VPN or email needs a reset and a session revocation there too.
• Check outbound traffic. Look in egress logs for KYT API calls from hosts that should not make them, or calls made while the API was supposed to be down.
• Record compliance gaps. Log every screening decision made without KYT during the outage and how you made it. If you had no documented fallback, a regulator may later ask how you covered the gap.

A practitioner’s note on vendor keys

When we run an assumed breach assessment, the vendor API key nearly always turns up in more places than the owning team thinks: a CI variable, a developer’s dotfile, a forgotten staging config, a Git commit someone reverted but never purged.

Run gitleaks or trufflehog over your organization’s full commit history, not just the HEAD of each branch. If you run Azure, enumerate app registrations and service principals that hold secrets or certificates, and check Key Vault diagnostic logs for Get and List calls from principals you do not recognize.

If your cloud identities are reachable by an agent that reads public GitHub, assume a leaked secret will be found within minutes. Agent-driven intrusions like the ARTEX cases stress exactly the controls an AI agent penetration test examines: token scope, egress and how fast an over-privileged identity turns into data loss.

What is still unknown about the Chainalysis breach?

Chainalysis has not disclosed:

• the initial access vector for the all-user exposure
• the password hashing algorithm
• which kinds of token were live (session, API or refresh)
• the dwell time
• whether the on-path attack and the internal-tools access are a single chain

It has not named an actor or given a date for bringing Reactor and Data Solutions back. Until it does, plan on the assumption that every credential your organization ever entered into Chainalysis is burned.

FAQ

What happened in the Chainalysis data breach?

Chainalysis disclosed on 6 November 2026 that an ongoing multi-front attack exposed names, usernames, password hashes and live tokens for all users. It took Reactor, Data Solutions, KYT, address screening and its login page offline while it investigates.

Was Chainalysis investigation data accessed?

Chainalysis says it has no evidence that investigations data was accessed or that its attribution data was manipulated. The investigation is still open, so that statement covers only what has been reviewed so far.

Is Chainalysis KYT down?

Yes. The KYT user interface and API were taken offline. Restoration begins with KYT and Address Screening for customers who have sent trusted IP addresses to Chainalysis support or their account team, followed by password resets and API key rotation.

Should I change passwords I reused with Chainalysis?

Yes. Password hashes for all users were exposed, and Chainalysis itself advises resetting passwords on other systems where you reused that credential. Revoke active sessions on those systems as well.

What is the Chainalysis on-path attack?

In an earlier statement, Chainalysis said an on-path (adversary-in-the-middle) attack exposed a subset of customer passwords and that this vector has been addressed. It has not published technical details or said whether the same vector led to the all-user exposure.

Who attacked Chainalysis?

No one has been named. Chainalysis compared the activity to recent attacks on many other tech platforms, but it has not attributed the intrusion to any actor or tool, including ARTEX.

If a vendor’s keys are spread through your pipelines or your service principals hold more access than anyone has mapped, agent::offense can test that blast radius the way an attacker would. Start with our assumed breach assessment.