The company police call when crypto goes missing is now the crime scene. The Chainalysis breach has grown from “just names and emails” to password hashes and live login tokens for every user, and its flagship investigation tool is still dark.
What Happened?
Chainalysis says an outside actor used “offensive agentic techniques” (AI agents doing the attacker’s legwork) to get into its systems and internal tools in October. Its October 30 notice said only names, emails, user IDs, and role labels were touched.
That story didn’t last. On November 2, Reactor and Data Solutions went offline. On November 4, the firm confirmed an on-path attack had exposed a subset of passwords, then pulled KYT and its own login page over “abnormal activity.” That night it admitted names, usernames, password hashes, and live tokens for all users were exposed, as The Record reported. Its own description: an “ongoing multifront cyberattack.”
What they said. What they found.
The gap between the first notice and the latest one is the gap between a phishing risk and an account takeover risk.
“Non sensitive” data
- User IDs
- Full names
- Email addresses
- Organization role labels
- No evidence of passwords, MFA secrets or session tokens
All users, credentials included
- Names and usernames
- Password hashes
- Live tokens
- Some passwords via on path attack
- Some KYT accounts accessed without authorization
Source: Chainalysis security incident updates. Hashing algorithm not disclosed.
Five Days, Four Rewrites
Each update widened what the attacker got. The Register and BleepingComputer tracked the changes as they landed.
Five days. Four rewrites of the same breach.
Each update widened what the attacker got. The first notice said no credentials. The last one said every user’s hashes and live tokens.
Source: Chainalysis security incident updates, Oct 30 to Nov 4, 2026. Reactor and Data Solutions: no return date.
What Chainalysis Says Wasn’t Touched
So far, the company says it has no evidence that investigators accessed the data or altered its attribution data. That matters more than usual here. Chainalysis tooling has supported takedowns of laundering network AudiA6 and bulletproof host Virtualine, and helped disrupt LockBit. A tampered attribution label could send an investigation down the wrong road.
What’s the Impact?
A live token can open an account without a password, so the risk is immediate. Reactor serves police and investigators. KYT feeds anti-money laundering checks at exchanges and banks, as American Banker noted. With screening down, some firms lost a core compliance control overnight, with no restore date for Reactor.
How to Avoid This
- Reset your Chainalysis password from the real login page, never from an emailed link
- Change that password anywhere else you reused it
- Rotate every API key and revoke tokens tied to vendor integrations
- Switch to passkeys or FIDO2 keys, which an attacker in the middle can’t replay
- Treat any “fund recovery” or recruiter message using the Chainalysis name as a scam until verified
How Restoration Works
KYT and address screening run behind an IP allowlist. Customers send trusted IPs to their account team, then reset passwords and rotate API keys, per crypto. news. Reactor and Data Solutions have no return date.
The crypto crime toolkit, mostly dark.
Investigators and compliance teams lost core tools mid week. Here’s where each product stood after the latest Chainalysis update.
Source: Chainalysis Nov 4, 11:00 PM EST update. Every user must reset.
Your Vendor’s Breach Is Now Your Login Problem
A stolen token doesn’t care whose platform it came from. If your team still learns about vendor exposure from the news, the grunt work of rotating, revoking, and monitoring is landing too late.
Secure.com puts governed AI Teammates on that work while your people stay in charge:
- SOC Teammate flags sign-ins from new IPs and token reuse after a reset, then escalates to a human under approval rules you set
- Red Teammate tests your login flows the way an AitM kit would and hands defenders the gap to close
- Cloud Security Teammate finds long-lived API keys and stale tokens tied to third-party tools and opens the rotation with full context
Every action runs inside scoped permissions and approval gates. Attack. Harden. Prove. Repeat.
The Bottom Line
The firm that traces stolen crypto couldn’t keep its own tokens in the vault. When your next vendor goes dark, know which keys to kill before the attacker uses them.
