What happened
- Chainalysis, a blockchain analysis firm, said a recent attack on its systems and internal tools exposed credentials and live tokens for all its users. BleepingComputer published it on 6 November 2026.
- The previous Friday the company had disclosed that attackers using AI tools accessed names, emails, user IDs and organizational role labels, through what it described as “offensive agentic techniques”.
- At first it said the impact was limited and involved only non-sensitive identity metadata. Later updates showed that usernames and password hashes for all its users had been exposed in an on-path attack.
- On Monday it discovered that names, usernames, password hashes and live tokens for all users were exposed to a malicious actor.
Why it matters
- Chainalysis provides tools for tracing cryptocurrency transactions and investigating fraud, ransomware and money laundering. Its user list includes law enforcement, government bodies, financial institutions, insurers and crypto businesses.
- Live tokens and API keys allow acting as the user, so resetting passwords is not enough: keys must be rotated too.
- The breach hits a company that sells security and traceability, which raises the cost of trust in its products.
The number
No evidence of access to investigations. Chainalysis says that so far it has no sign that investigations data was accessed or that its attribution data was manipulated. It is a claim by the company, with no outside verification in the text.
Context
The company locked accounts as a precaution and asked for password resets. It later took the login portal offline, together with Reactor, Data Solutions, the Know-Your-Transaction interface and API and its address screening products, after detecting further abnormal activity.
To regain access, users must provide trusted IP addresses to their account team or support. With that they will be able to reset passwords and rotate API keys before registering transactions. The company says it is working to harden its systems and bring Reactor and Data Solutions back online, with additional access protections.
BleepingComputer places the case among several recent incidents in the crypto world. Ledger asked Asian resellers and distributors last month to pull products while it investigates hardware implants, and Binance reported that North Korean hackers stole roughly US$ 6.34 billion after infecting an employee’s laptop during a fake job interview.
At Mamífero we have followed attacks on the sector. We reported that Binance blames a US$ 6.34 billion theft on a fake job interview and that a new wave of cyberattacks hit Daishin, Mirae and Bithumb. Also that data on more than 40,000 Homeland Security staff was published and that the United States warned of attacks on industrial refrigerators.
What’s next
- Users will have to provide trusted IPs to regain access to the portal.
- Everyone will have to reset passwords and rotate API keys before registering transactions.
- The company must finish hardening its systems before reopening Reactor and Data Solutions.
Bottom line
A breach that began as a minor metadata problem ended with the portal offline. In security, the first figure is rarely the last.
Sources
- BleepingComputer, “Chainalysis says breach exposed credentials for all customers”, 6 November 2026, link. The company’s quotes come from its statements, according to the outlet.
- Cover image: Shixart1985, CC BY 2.0, via Wikimedia Commons
Edited by Rodrigo Cornejo. How we select and verify: who writes these notes.
