A major security incident at blockchain analytics company Chainalysis has taken a more serious turn. The company now warns that information belonging to all its users was exposed during a cyberattack. The incident has also disrupted several services, raising concerns among customers across cryptocurrency, finance, law enforcement and national security sectors.
In an update published Wednesday night, Chainalysis disclosed that attackers accessed sensitive customer information. The exposed data included names, usernames, password hashes and live tokens. However, the company did not clarify whether every information category was exposed for every user.
The disclosure follows an earlier announcement on October 30. At that time, Chainalysis said it had found no evidence of compromised authentication credentials or session tokens. However, its latest findings indicate a broader exposure than initially reported.
What Happened in the Chainalysis Cyberattack?
Chainalysis said it detected an external actor using “offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools.”
However, the company has not identified the attacker or explained what these techniques involved. It also has not confirmed whether an AI agent directly caused the breach.
Earlier, the company described the incident as part of “an industry-wide rise in AI-driven cyberattacks.” Nevertheless, it stopped short of directly attributing its own security incident to artificial intelligence.
To investigate the breach, Chainalysis has hired “world-class third-party cybersecurity experts.” The company says these specialists are helping examine the incident and strengthen its security systems.
According to its website, Chainalysis serves more than 1,500 customers. These include cryptocurrency businesses, financial institutions, regulators, law enforcement agencies and national security organisations.
Despite the exposure, the company said it had found no evidence of compromised investigative information.
“At this time we continue to have no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated,” the company said Wednesday night.
Password Hashes and Live Tokens Raise Security Concerns
The exposure of password hashes and live tokens has added another layer of concern. However, Chainalysis has not explained what it meant by “live tokens” or how it hashed the exposed passwords.
Password hashes can sometimes be cracked to recover original passwords. Similarly, active authentication tokens could allow attackers to access accounts without entering passwords.
Therefore, Chainalysis has instructed all users to reset their passwords. It has also advised customers to rotate their API keys where appropriate.
Additionally, the company urged users to visit its login page directly. Customers should avoid following links contained in password-reset emails.
Suspected Account Access Forces Services Offline
The security incident has also affected Chainalysis’s Know Your Transaction (KYT) service. The platform helps customers monitor cryptocurrency transactions for suspicious activity.
The company said some customer accounts appeared to have been accessed. It also disclosed that certain passwords were exposed through an “on-path attack.”
In this type of attack, a malicious actor intercepts communications between users and a service. An email to affected customers described an “ongoing multifront cyberattack” without identifying its other components.
Chainalysis said it had contained and fixed the interception method. It was also locking affected accounts and reported no evidence of improper account access.
However, around 40 minutes later, the company announced further restrictions. It took the KYT user interface and API offline following “abnormal activity.”
Other affected services included address-screening products and the company’s login page. Consequently, customers could not immediately complete the password resets they had previously been instructed to perform.
Restoration Plans Remain Unclear for Several Products
The shutdown expanded restrictions introduced on Monday. At that time, Chainalysis had taken its Reactor investigations tool and Data Solutions product offline as a precaution.
However, its compliance transaction-monitoring products continued operating. Chainalysis describes these services as important tools for detecting money laundering across the cryptocurrency ecosystem.
The company planned to begin restoring KYT and Address Screening on Thursday. Customers must first submit trusted IP addresses for inclusion on an allowlist.
After that process, customers should regain access to password resets and API key rotation. However, Chainalysis has not provided restoration dates for Reactor, Data Solutions or Chain (Beta).
It has also not explained how customers can screen transactions while KYT remains unavailable.
Furthermore, the company has not established whether the password interception, data exposure and suspected account access involved the same attacker or methods.
A spokesperson said the company could not provide information beyond its published update. Meanwhile, the investigation continues as customers await further clarification about the breach and affected services.
For the latest updates, visit and follow The Truth International website (www.thetruthinternational.com) and subscribe to the YouTube Channel.
