Chainalysis incident updates November 4 and November 6, 2026; first disclosure October 30, 2026
From a Subset to Every User: Chainalysis Says Password Hashes and Live Tokens for All Users Were Exposed
Chainalysis widened its breach disclosure twice in six days, and the second widening reversed the first assurance. The blockchain analysis firm first disclosed unauthorized access on October 30 and said it had found no evidence that authentication credentials or session tokens were accessed. Late on November 4 it said the opposite in substance: customer information exposed to an attacker includes names, usernames, password hashes and live tokens covering all Chainalysis users, and the company has not said whether every type of data applies to every user. Earlier on November 4 it described a separate on-path attack, in which an attacker sits between a user and the service, that exposed a subset of customer passwords; that route has been contained, and the affected accounts were locked. The operational impact is the other half of the story. Reactor and Data Solutions were taken offline on November 2 and were still offline at the November 6 update. After abnormal activity on November 4, the company also took the Know Your Transaction (KYT) interface and API, its address screening products and its login page offline, and on November 6 it began restoring KYT and Address Screening in phases, gated on customers supplying trusted IP addresses for an allowlist. Every user will need a new password and new API keys where they use them as access returns. Chainalysis continues to report no evidence that investigations data was accessed or that its attribution data was manipulated, and it says this incident is separate from the Binance theft. What remains undisclosed is material: no user count, no attacker identity, no explanation of how the on-path attack was positioned, and no confirmation of whether the ARTEX framework was used, which the company has not stated.
Executives
Treat this as a vendor continuity event, not only a password event. If your compliance screening runs through the KYT API, your team lost a control it depends on when the vendor turned itself off, and restoration is gated on work only you can do: supplying trusted IP addresses. Ask today whether your organization has registered its addresses, whether every Chainalysis password has been reset and every API key rotated, and what your screening fallback is while Reactor and Data Solutions remain offline with no restoration date.
CIO / CISO
Act on the widest disclosure, not the first one. The sequence here, no credentials accessed on October 30, then hashes and live tokens for all users on November 4, is the standing lesson: scope statements early in an incident are minimums. Require the full credential lifecycle in your vendor follow-up, password reset, live token invalidation, and API key rotation, and ask the question this incident makes unavoidable for every critical vendor: if you took your own login page offline, how would we work, and what would you need from us first. Log the allowlist submission as a tracked action with an owner.
Engineers
Do the mechanical work in order. Register the trusted egress addresses your KYT and screening integrations actually use, then reset passwords through the normal login page rather than any link in an email, because the company warns about impersonators offering recovery help. Rotate API keys in every environment, including test integrations that share production credentials, and hunt for any reuse of a Chainalysis password on other systems, since the company itself advises changing reused credentials elsewhere. Keep the two exposures distinct in your records: the platform exposure of hashes and tokens, and the on-path exposure of a subset of passwords.
Everyone (non-IT)
If you hold a Chainalysis account for work, the instructions that reach you are simple: when your access returns, set a new password and expect new API keys, and do it through the normal sign-in page, not through an unexpected email or message. If you only use a crypto exchange that works with Chainalysis, this disclosure does not say your exchange account or wallet was affected, and no stolen funds are reported in it. Be wary of anyone who contacts you claiming to recover funds from this incident; the company warns that scammers are posing as Chainalysis.