Chainalysis breach, blamed on agentic techniques, exposed password hashes and live tokens for all users

On October 30, 2026, the blockchain analysis company Chainalysis disclosed that an outside actor had gained access to its internal systems and tools. Its email to customers said the intruder used "offensive agentic techniques" but did not define the term, name any tool, or state outright that AI agents ran the attack. The same email ties the company's security push to a rise in AI-driven attacks and says it is using large language models in its own review. At that point Chainalysis reported only user IDs, full names, email addresses and organization role labels as accessed, with no evidence that passwords, MFA secrets or session tokens were taken.

The incident grew the following week. On November 2, Chainalysis took Reactor and Data Solutions offline as a precaution. On November 4 it said an on-path attack had exposed a subset of customer passwords and locked those accounts, then took KYT, its address screening products and the login page offline after spotting abnormal activity. Late that day it disclosed that names, usernames, password hashes and live tokens for all Chainalysis users had been exposed, a finding it made on November 2. It added that some KYT accounts appear to have been accessed without authorization and that it is contacting those customers directly, and it reported no evidence that investigation data was read or attribution data altered.

In its November 6 update, Chainalysis said access to KYT and Address Screening was returning in phases. Customers must send trusted IP addresses for an allowlist, and every user has to reset their password and, where applicable, rotate API keys before registering transactions. Reactor and Data Solutions remained offline with no restoration date. The company has not named the attacker, published how many users were affected or said whether exposed tokens were revoked, and it says the incident is unrelated to the recent Binance theft.