What Did Chainalysis Say Was Exposed?

Names, usernames, password hashes and live tokens for all users. The company also said an “on-path attack” exposed a subset of customer passwords, and it is notifying customers whose KYT accounts appear to have been accessed without authorization. Its email described a continuing attack on multiple fronts without naming them, per The Record.

Plain English: a password hash is a scrambled version of a password, and it has to be cracked before it is useful. A live token is an active sign-in code. It can let someone act as a logged-in user without a password, which makes it more urgent.

How Did the Story Change in a Week?

  • Oct. 30: Chainalysis reported a breach and said it found no evidence that credentials or session tokens were touched.
  • Nov. 2 (Monday): it discovered the wider exposure.
  • Nov. 4 (Wednesday): it disclosed all-user exposure of hashes and live tokens.
  • Nov. 6: it took its login portal offline, per reporting citing BleepingComputer.

What Is Offline, and What Should Customers Do?

Chainalysis took KYT and other services offline. A secondary summary says it is restoring KYT and Address Screening only for customers who register trusted IP addresses on an allowlist, reset passwords, and rotate API keys. We haven’t confirmed that against Chainalysis’s own notice. Customers who reused a Chainalysis password elsewhere should change it too.

What Is Still Unknown?

Several things. Chainalysis has not given a user count, said how passwords were hashed, or specified the token type. It has not said whether one actor was responsible for every exposure. Some outlets describe an “agentic” or AI-agent-style attack. That description traces to the company’s update as relayed by others, and AI involvement is unverified.

What Happens Next?

  • Whether Chainalysis publishes a technical post-mortem or user count
  • When KYT and Reactor return for all customers
  • Whether the exposed tokens were used against customer data

FAQ

What did the Chainalysis breach expose? Names, usernames, password hashes and live tokens for all users, per the company.

Is my crypto at risk? Chainalysis is an analytics vendor, not a custodian. The exposure concerns customer accounts and tools, not user funds.

Is it linked to the Binance hack? The company says no.

What should Chainalysis customers do? Reset passwords, rotate API keys, and follow the company’s allowlist steps for restoring services.