Chainalysis disclosed in a security update that an intruder accessed names, usernames, hashed passwords, and active session tokens across its entire user base. The company stated that "certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor."
The analytics firm provides transaction tracking and regulatory compliance tools to upwards of 1,500 institutional clients across law enforcement, national security agencies, banks, and digital asset exchanges.
Platforms Taken Offline
Following the discovery, Chainalysis pulled several core platforms offline, including its Know Your Transaction monitoring service, address screening systems, Reactor investigation platform, Data Solutions, and Chain beta product. Earlier that day, the firm acknowledged that an on-path interception attack had compromised passwords for certain users, prompting it to lock affected accounts.
After detecting abnormal activity in its screening systems, Chainalysis directly reached out to customers whose accounts showed indications of unauthorized access. The firm claimed its investigators found no indication that confidential case materials were compromised or that blockchain attribution records had been modified. Chainalysis also said the security incident was completely unrelated to the recent $6.3 billion theft from crypto exchange Binance.
Restoration and Credential Controls
Chainalysis initially disclosed an intrusion on October 30, 2026, reporting that an attacker used offensive agentic methods to access internal tools while maintaining at the time that login credentials and session tokens remained uncompromised.
Chainalysis began a phased reactivation of transaction monitoring and screening tools, requiring trusted IP allowlisting, mandatory password resets, and updated API keys.
