Chainalysis Acknowledges Password Hashes and Active Tokens Leak

Chainalysis, a company providing blockchain transaction analysis tools, acknowledged that a recent cyberattack exposed password hashes and active user tokens to the attacker. This was stated in an updated incident notification published on November 4, 2026.

Previously, on October 30, Chainalysis reported only the disclosure of user IDs, names, email addresses, and employee role information. At that time, the company claimed it had found no signs of access to credentials or session tokens.

However, further investigation revealed a broader scope of compromise.

According to Chainalysis, on November 2, specialists determined that the attacker gained access to names, logins, password hashes, and active tokens related to platform users.

The company indicated that the incident affected all user data but did not specify whether all listed categories of information were disclosed for each account. The type of compromised tokens is also not disclosed.

Separately, Chainalysis confirmed that a man-in-the-middle attack resulted in the disclosure of some client passwords. This method allows an attacker to intercept information transmitted between the user and the service.

The company stated that it has eliminated this attack method, started blocking affected accounts, and required relevant users to change their passwords.

Chainalysis temporarily disabled analytical services

The incident also affected the availability of Chainalysis products used by financial organizations and participants in the cryptocurrency market.

On November 2, the company suspended the operation of Reactor and Data Solutions for additional security checks.

On November 4, after detecting suspicious activity, the cryptocurrency transaction monitoring service Know Your Transaction (KYT), its API, address verification tools, and login page were disabled.

Chainalysis reported that it is directly notifying clients whose KYT accounts were presumably accessed without authorization.

To restore the operation of individual services, the company suggested organizations provide trusted IP addresses. Once included in the whitelist, users will be able to change passwords and update API keys if necessary.

Meanwhile, Chainalysis emphasized that it has not yet found signs of access to investigation materials or changes to blockchain address attribution data.

The investigation continues with the involvement of external cybersecurity specialists. The company has not disclosed the number of affected accounts, the identities of the attackers, or the full list of vulnerabilities exploited.

Chainalysis also warned clients about the necessity of opening the authorization page directly, avoiding links from suspicious password reset emails. Additionally, it is recommended to change reused passwords on other services.

The timeline for the full restoration of all products and the final consequences of the attack have not yet been determined.