At 11:00 pm Eastern on 4 November 2026, which is 04:00 UTC on 5 November, Chainalysis said names, usernames, password hashes, and live tokens for all of its users had been exposed to an attacker. It said it still had no evidence that investigation files had been accessed, and no evidence that its attribution data had been changed. The firm sells tracing and screening tools to exchanges, compliance teams, and investigators. A login there is not a bitcoin wallet, and this page will not describe how the access was gained.
The first public note was on 30 October. It said an outside actor had used what Chainalysis called offensive agentic techniques to reach its systems and internal tools. It said the investigation so far had found no evidence of unauthorised access to investigation content, authentication credentials, or session tokens. It said some names, email addresses, user IDs, and organisation role labels had been accessed. It also said the incident was not the Binance theft. The 4 November note is a different sentence about credentials. This page will not describe the technique the 30 October note named.
What happened
On 2 November Chainalysis took Reactor and Data Solutions offline while outside experts kept assessing them. It kept the compliance monitoring products running at that point, and said it was watching them. On the morning of 4 November it told some customers that what it called an on-path attack had exposed a subset of passwords, locked those accounts, and told people to reset the password on the usual login page rather than by clicking a link in an email. It did not describe that attack. Later the same morning it found abnormal activity and took the know-your-transaction screen and its API offline, along with other address-screening products and the login page. Reactor, Data Solutions, and a product it calls Chain, still in beta, stayed offline. People who had just been told to reset a password could not, because the login page was down. The firm still told them to change that password anywhere else they had reused it.
The 11:00 pm note is the one that widens the credential finding from a subset of passwords to every user. Password hashes are not the password written out. Chainalysis has not said which method produced the hashes, so this page will not say whether they can be reversed. Live tokens are the firm’s words. It has not defined them here. A hash and a token are both credentials for a Chainalysis login. They are not a seed phrase, and they are not the coins a customer of an exchange holds. The firm said it is notifying customers whose know-your-transaction accounts appear to have been used without permission. That is a smaller group than “every user had a hash exposed.”
The same note says Chainalysis intended to start restoring know-your-transaction and address screening on 5 November, and only for addresses a customer had asked to be allowlisted, through support@chainalysis.com or an account manager. After that, users would reset passwords and rotate API keys. Reactor and Data Solutions were still being hardened. Every user, it said, will have to reset passwords and rotate API keys as appropriate. As of the evening of 5 November the blog’s latest stamp was still that 11:00 pm note. An intention to restore is not a statement that the screen is back.
Why it matters
If you have a Chainalysis login, the 30 October line that credentials had not been accessed is no longer the line. Reset the password on the login page you already use, not from a link in a mail, and do not reuse it. If that password was also the password on an exchange or an email account, those are separate doors. See How do you keep crypto safe?. See How crypto wallets actually work if a vendor login and a key still feel like the same object. Nobody restoring a Chainalysis seat needs a recovery phrase.
If you only hold coins, this incident did not spend them. Chainalysis appears in other stories on this site as a firm that helps trace and freeze tokens. Mercado Bitcoin says customers will not lose. Binance puts the hot-wallet loss near $6.3 billion. Those are exchange tills. This is the tracer’s own customer database. A freeze Chainalysis helped arrange is not undone because its login page was taken down, and a login page taken down is not those coins returned.
What happens next
Whether know-your-transaction and address screening actually reopened, behind the allowlist the 11:00 pm note described. When Reactor and Data Solutions come back. Whether the firm says how the hashes were made, which it has not. The customers it said it would notify because a know-your-transaction account looked used. Watch Chainalysis’s own blog. We will not treat “no evidence the investigation files were opened” as “no credential was exposed”, and we will not describe the access.
Not a recommendation to buy, sell, or avoid any crypto asset because a tracing firm was breached. Not a finding that law-enforcement case files were copied. Not a description of the access. The firm’s own later note is a credential exposure for every user, a login that was switched off, and a claim that the investigation files were not the thing taken.
