The blockchain analytics company has begun restoring selected services after disclosing exposure affecting all users, expanding substantially on its initial assessment of the incident.
Chainalysis has disclosed that a cyberattack exposed customer information associated with all its users, including names, usernames, password hashes and live tokens. The incident also triggered shutdowns across several investigation and transaction-screening products, creating disruption for organisations that use its tools to monitor cryptocurrency activity.
The company’s November 4 disclosure significantly widened the scope of the breach first announced on October 30. Its initial assessment had identified access to customer profile information but reported no evidence that authentication credentials or session tokens had been compromised. Subsequent findings changed that assessment.
Chainalysis serves more than 1,500 customer organisations across cryptocurrency businesses, financial institutions, law enforcement, regulators and national security. That customer count does not represent the number of affected individuals, which the company has not disclosed. Its statement also leaves unclear whether every listed category of information was exposed for every user.
Investigation uncovers wider exposure
The company’s original notification described unauthorised access to internal systems and tools during October. Information initially identified as accessed included user IDs, full names, email addresses and organisational role labels. Chainalysis said it was investigating the activity, patching vulnerabilities and strengthening its systems.
On November 4, it separately notified certain customers that an interception method described as an “on-path attack” had exposed a subset of customer passwords. It said that attack method had been contained and remediated and affected accounts were being locked as a precaution. The disclosure did not establish that every user’s plaintext password had been exposed.
The company has not publicly explained whether the password interception, broader exposure of hashes and tokens, and suspected unauthorised account access resulted from the same intrusion method or attacker. The perpetrators remain unidentified.
Product shutdowns expand before phased recovery
Chainalysis initially withdrew Reactor and Data Solutions on November 2 while leaving compliance transaction-monitoring services operational under additional monitoring. Two days later, abnormal activity prompted it to take the Know Your Transaction platform’s interface and API offline, alongside address-screening products and its login page. It began notifying customers whose KYT accounts appeared to have been accessed without authorisation.
In its latest update, issued November 6, Chainalysis said phased restoration of KYT and Address Screening had begun. Customers were asked to submit trusted IP addresses for allowlisting. Users must reset passwords and rotate API keys where applicable before registering transactions. Work to restore Reactor and Data Solutions continued.
Investigation data remains a separate question
Chainalysis said it continued to have no evidence that investigation data had been accessed or its blockchain attribution data manipulated. That assessment remains distinct from the confirmed exposure of user information and suspected access to certain KYT accounts.
The company described the intrusion as involving “offensive agentic techniques,” but has not published sufficient technical detail to establish precisely how artificial intelligence contributed. It has engaged external cybersecurity specialists and is using large language models to support its security review.
Customers have been advised to visit the official login page directly, remain alert to unexpected authentication requests and change passwords reused elsewhere. Chainalysis says its incident is unrelated to the separate Binance cryptocurrency theft.
