Chainalysis: credentials for every customer

Chainalysis told customers on November 6, 2026 that the intrusion into its systems and internal tools exposed credentials and live tokens for every user. The firm sells blockchain tracing to law enforcement, government agencies, banks, insurers, and cryptocurrency businesses. A live token for one of those seats can still act as that analyst until it is rotated. A password hash can be tested anywhere the same password was reused.

The first public account, last Friday, was narrower. Chainalysis said attackers using AI tools had reached names, email addresses, user IDs, and role labels, and it described the loss as non-sensitive identity metadata. Later updates added usernames and password hashes for all customers, exposed through an on-path attack. The Wednesday note dates the broader finding to Monday: names, usernames, password hashes, and live tokens for every Chainalysis user were exposed. The company says it still has no evidence that investigation files were read or that its attribution data was changed.

The login page is offline on purpose

After some passwords turned up in the review, Chainalysis locked accounts and told people to reset before signing in. Further abnormal activity changed that plan. The login portal is down. So are Reactor, Data Solutions, the Know Your Transaction interface and API, and the address-screening products. A reset mail that points at the usual login will fail until the company turns that page back on. The lock does not retire a password that also opens mail or a VPN.

Return, as Chainalysis describes it, starts with an allowlist. Customers send trusted IP addresses to [email protected], the address in the company’s own notice, or to the account team they already have. Only then does the company open a path to reset passwords and rotate API keys. Reactor and Data Solutions stay offline while those systems are hardened. Every user will have to reset a password and rotate keys before registering transactions again.

What to do before the portal returns

Treat every provisioned user as exposed. The company said all customers, so a team waiting for a named-seat list should change reused passwords today. Put the new secrets in a manager the Chainalysis login does not unlock.

Hold automated jobs that call KYT or address screening. Inventory the API keys those jobs use, and schedule the rotation for the hour access returns. Send the allowlist from a channel you already trust, and keep the ranges to the addresses analysts and integrations actually use.

Tell staff that a Chainalysis password page, a recovery call, or a recruiting note is untrusted until someone on the account team confirms it. Role labels left in the first disclosure. Hashes and live tokens are in this one. When the allowlist opens, reset the password, rotate every key, and confirm the old tokens no longer authenticate. Ask Chainalysis for the per-organization record of what was exposed once the count is finished. A token that has been read has to be expired. A password that left as a hash has to be retired everywhere else it was typed.

This briefing relies on public reporting by BleepingComputer and on Chainalysis’s customer updates.