Chainalysis said all users were affected by a cyberattack after an on-path attack exposed a subset of customer passwords, including the recipient’s, according to a November 4 update. The disclosure reversed the company’s initial assessment of an incident it said began with an attack on October 30, 2026. Its earlier notice said it had found no evidence that credentials or session tokens were exposed.
The company said the attack was contained and remediated, and required affected users to reset passwords. It also said customers should rotate API keys as appropriate. The breach disrupted access to products used by governments, law enforcement agencies and businesses to track cryptocurrency transactions.
How the Password Exposure Expanded
In its October 30 notification, Chainalysis described the attack as “similar to many other tech platforms in recent weeks.” It said the incident was unrelated to the recent crypto theft involving Binance. The company initially said attackers accessed non-sensitive user information, including user IDs, full names, email addresses and organization role labels.
Chainalysis later said attackers used “offensive agentic techniques.” At first, its investigation found no evidence that investigation content such as graphs, notes or cases had been accessed. The company also said it had not found evidence of compromised transaction or query results, passwords in clear text, multi-factor authentication secrets or user session tokens.
That assessment changed on November 4. “Today, we confirmed that as a part of this incident, an ‘on-path attack’ exposed a subset of customer passwords, including yours,” the company said in an email to affected parties. Chainalysis said it had contained and remediated the attack vector. The company did not say in the supplied account how many passwords were exposed.
Services Face a Cautious Restoration
Chainalysis locked users out and directed them to reset credentials through its standard login page. It also took Reactor, Data Solutions and Chain (Beta) offline “out of an abundance of caution.” The company separately cited abnormal activity when it took down the KYT user interface and API, other address screening products and the login page.
The company said it had begun partially restoring KYT and Address Screening. It told customers to expect access to return “over the next several hours,” while saying it was proceeding carefully and monitoring each phase. Customers seeking access sooner were invited to submit a trusted IP address by email and prepare to reset credentials.
Chainalysis said it was working “around the clock” to harden its systems and restore Reactor and Data Solutions. The company acknowledged the disruption and thanked customers for their patience. The source account did not provide a completion date for restoring those services.
Why the Incident Matters for Crypto Investigations
Chainalysis describes its work as blockchain analytics used by governments, law enforcement agencies and businesses to track and investigate cryptocurrency transactions. The source says police have used its tools to trace stolen funds, identify illicit activity and investigate cryptocurrency-related crimes. On-chain fund tracking offers a related example of how analysts follow stolen cryptocurrency.
Coverage of officers tracing crypto crime also examines law enforcement’s use of blockchain records. Separately, analysts have traced funds in the Binance hack investigation, a topic the source distinguishes from the Chainalysis incident.
The source account said no threat actors had claimed responsibility and the data had not appeared on the dark web at that time. It did not report an extortion demand or say attackers had contacted Chainalysis. The company’s stated next steps were continued system hardening, careful restoration and additional account protections, including password resets and API key rotation where appropriate.
