Chainalysis Breach Exposes Password Hashes and Live Tokens for All Users, Shuts Down KYT and Reactor

Chainalysis disclosed that password hashes and live authentication tokens for all users were exposed to a malicious actor, expanding on its October 30 report of compromised customer information. The blockchain intelligence firm said in a November 4 update that it had shut down its KYT transaction monitoring, address screening, Reactor and Data Solutions services, according to Bitcoin.

Chainalysis Widens Breach Disclosure to All Users

In the update published Wednesday, November 4, at 11 p.m. ET, Chainalysis said it discovered on Monday that customer information including names, usernames, password hashes and live tokens had been exposed. The company also confirmed suspicious activity involving its compliance monitoring products.

The disclosure escalates from the company's October 30 announcement, when Chainalysis said hackers had accessed basic customer information but found no evidence of compromised authentication credentials or investigation data. Earlier on November 4, Chainalysis confirmed that an "on-path attack" had compromised passwords belonging to a subset of customers, and said that method had been contained and remediated.

Chainalysis said it took its Know Your Transaction monitoring platform offline, including its user interface and API, along with address screening products and its login page. Reactor, Data Solutions and Chain (Beta) were also shut down. The company said it detected abnormal activity in its transaction screening systems after introducing additional monitoring measures, and is directly notifying customers whose KYT accounts appear to have been accessed without authorization.

Chainalysis said it has not found evidence that confidential investigation data was accessed or that its blockchain attribution data was manipulated. The company has not disclosed how many users or organizations were affected.

Chainalysis's Funding and Product Record

Chainalysis is a blockchain data platform that sells investigation, compliance, security and fraud-prevention software to more than 1,500 customers in over 70 countries, including governments, regulators, exchanges, banks and stablecoin issuers, according to akta.pro company records. The same records list total funding of $536.6 million at Series F stage, with the last round dated October 16, 2025, and a revenue estimate of $250 million to $500 million.

The records also list a $150 million acquisition of Alterya in January 2025 to add AI-powered fraud prevention, and the March 2026 launch of Blockchain Intelligence Agents, natural-language AI agents that conduct multi-chain investigations and compliance workflows.

Earlier Chainalysis Incident Disclosures

Chainalysis first disclosed the incident on October 30, 2026, saying it had detected a cybersecurity incident affecting its systems and internal tools, with some non-sensitive customer data accessed, Blockchain News reported. The company said at the time it found no evidence of unauthorized access to investigation content, credentials or session tokens.

On October 31, 2026, Chainalysis said an attacker using "offensive agentic techniques" had accessed customer names and emails, with no evidence of more sensitive data such as investigation contents or unencrypted passwords, The Block reported. On November 2, 2026, Chainalysis said it helped freeze nearly $10 million in stolen funds after Mercado Bitcoin's security incident, which it said led to about $49 million in stolen assets, Blockchain News reported.

Chainalysis Service Restoration Plans

Chainalysis plans to begin restoring KYT and Address Screening access on Thursday, November 5, using a system that requires customers to provide trusted IP addresses for an allowlist. Customers will then be able to reset passwords and rotate API keys, and the company said all users will be required to reset their passwords and rotate API keys where appropriate. Chainalysis said its investigation remains ongoing, with additional disclosures possible.