-13.png?w=1024)
Chainalysis helps financial institutions and investigators follow suspicious cryptocurrency transactions. Now the blockchain analytics company says attackers exposed password hashes and live tokens associated with its users, raising questions about how safely customers can access their accounts.
In an expanded disclosure, Chainalysis said information associated with all its users was exposed, without specifying whether every listed data category was exposed for every person. Its initial assessment found no evidence of credential or session-token exposure. The company also flagged possible unauthorized access to some Know Your Transaction (KYT) accounts and suspended several products. For customers that depend on its tools to screen crypto transfers, the incident creates both an account-security risk and a monitoring problem.
Chainalysis expands breach findings beyond customer profiles
In its Nov. 4 security update, Chainalysis said an attacker exposed names, usernames, password hashes, and live tokens associated with all users. Its initial notice described access to user IDs, emails, and organizational roles but found no evidence of credential or session-token exposure.
Chainalysis also said an ‘on-path attack,’ which intercepts communications between users and a service, exposed some customer passwords. It locked affected accounts and said that attack method had been contained and remediated. It also detected abnormal activity on KYT.
"We are directly notifying customers whose KYT accounts appear to have been accessed without authorization," the company said.
Password hashes are not plaintext passwords, and the risk depends on how they were secured. Live tokens could pose a different problem if usable for authentication. According to The Record, the company hasn't disclosed its hashing method, the tokens' function, or whether every data category was exposed for every user.
Chainalysis said it had no evidence that investigation data was accessed or blockchain attribution data manipulated. It also said its breach was unrelated to the recent Binance cryptocurrency theft.
KYT shutdown forces compliance teams to review screening gaps
Chainalysis took KYT's interface and API, Address Screening, and its login page offline after detecting abnormal activity. Reactor, Data Solutions, and Chain (Beta) were also unavailable. In its Nov. 4 update, Chainalysis said it intended to begin restoring KYT and Address Screening on Nov. 5 through a trusted-IP allowlist, then allow users to reset passwords and rotate API keys.
The KYT platform assesses risk on incoming and outgoing crypto transfers and alerts teams to suspicious transactions. An outage may interrupt an exchange's routine transaction reviews even without evidence that transaction records were altered.
Security and compliance teams should identify which checks were unavailable, document potential screening gaps, and review affected transfers after service returns. They should check the official Chainalysis status page rather than assume its announced restoration schedule was met.
What affected Chainalysis customers should do now
Chainalysis has instructed users to reset their passwords and rotate API keys where appropriate. In its Nov. 4 update, the company said account logins were temporarily unavailable, preventing customers from resetting their Chainalysis passwords at that time.
Affected organizations should follow Chainalysis's verified instructions and monitor its official service status before making changes. Security teams should also investigate whether exposed credentials were used for unauthorized access.
For organizations relying on Chainalysis for cryptocurrency transaction monitoring, the response should address both account security and any gaps created by the service disruptions.
- Secure accounts and review suspicious activity: Once password resets become available, users should create unique passwords and change any reused credentials on other services. Administrators should review available login histories for unfamiliar devices, IP addresses, or account changes.
Multifactor authentication should remain enabled, but teams should also confirm whether existing sessions were invalidated. Attacks involving malicious ChatGPT browser extensions illustrate how stolen session tokens can expose accounts without a fresh login. Password-reset instructions should be accessed through official Chainalysis channels rather than unsolicited emails.
- Audit tokens, API keys, and connected applications: Security teams should identify every system connected to Chainalysis, including automated transaction-monitoring tools, internal applications, and service accounts. Review their permissions and activity logs for unexpected requests or access patterns.
API keys should be revoked and replaced according to Chainalysis’s verified recovery instructions. Teams should prioritize revoking suspected compromised keys and use approved continuity procedures while restoring affected integrations. Organizations should also request clarification about whether exposed tokens remain valid or have been revoked.
- Address transaction-screening gaps: Exchanges and financial institutions using KYT should establish which monitoring functions were unavailable and identify transactions processed during the disruption. Compliance teams may need to apply approved alternative screening procedures, escalate higher-risk transfers for manual review, and preserve records of decisions made while the service was offline.
Once normal operations resume, affected transactions and outstanding alerts should be reviewed to identify activity that may have escaped routine screening.
Password resets alone may not eliminate the risks associated with exposed authentication tokens. Some phishing campaigns capture active session tokens to access accounts after users authenticate. Chainalysis has not confirmed that its exposed tokens could be used in the same way, making their capabilities and revocation status important questions for customers.
Organizations should also preserve relevant authentication logs, API activity records, and communications from Chainalysis while the investigation continues. Evidence of unauthorized access may not become apparent until activity is reviewed against the period when the affected services were operating.
Until Chainalysis clarifies the capabilities of the exposed tokens, the extent of unauthorized KYT account access, and whether existing sessions have been invalidated, customers should continue monitoring their accounts rather than assuming the incident is resolved after a password reset.
Read more: Stolen sessions can let attackers access accounts without knowing a password. Learn how infostealer malware hijacked Claude sessions and why securing the affected device matters alongside revoking account access.