• Chainalysis disclosed a cyberattack that exposed customer data, including hashed passwords and account information
  • Company took key services offline, forced password resets, and required additional security measures
  • Investigation continues as Chainalysis restores systems and assesses the full impact of the breach

Blockchain data analysis platform Chainalysis has disclosed suffering a disruptive cyberattack that forced it to shut down some of its services to prevent further damage, as sensitive data from all of its customers - including hashed passwords - were stolen.

On October 30 2026, the company issued a notification saying it was a target of an attack, “similar to many other tech platforms in recent weeks,” but “unrelated to the recent crypto theft involving Binance.”

At first, it did not look like a particularly dangerous hit - the initial investigation did not find evidence of unauthorized access to investigation content, authentication credentials, or session tokens.

On-path attack

The unnamed attackers used “offensive agentic techniques”, Chainalysis said, but believed at the time that investigation content (such as graphs, notes, or cases), transaction or query results, passwords in clear text, MFA secrets, or user session tokens were not compromised.

It did confirm non-sensitive data (user IDs, full names, email addresses, and organization role labels for users provisioned on the platform) as accessed.

On November 4, Chainalysis shared an update, confirming that this was a much bigger hit than initially believed.

“Today, we confirmed that as a part of this incident, an “on-path attack” exposed a subset of customer passwords, including yours,” the company said in an email sent to affected parties. “This attack vector has been contained and remediated.”

“Given this sensitive and urgent information, we are requiring you to reset your password.”

Users were locked out of their accounts and were forced to reset them using the standard Chainalysis login page. At roughly the same time, it also took down three products, Reactor, Data Solutions and Chain (Beta) “out of an abundance of caution”, and KYT (the user interface and API), other address screening products and the login page “due to abnormal activity.”

The company said it will require additional protections to access accounts, including having every user reset their passwords and rotate API keys as appropriate.

Chainalysis has now said it started restoring access to KYT and Address Screening, albeit partially, and that customers should expect to regain access “over the next several hours”, because it was “proceeding carefully” and monitoring each phase. Users looking to regain their access as soon as possible are invited to submit their trusted IP address via email and prepare to reset their credentials.

No word from the perpetrators (yet)

The company said it was still working “around the clock” to harden its systems and restore access to Reactor and Data Solutions. “We recognize the disruption this incident has caused and appreciate your continued patience and partnership as we work to restore our services safely,” Chainalysis said.

Chainalysis is a blockchain analytics company that governments, law enforcement agencies, and other businesses use to track and investigate cryptocurrency transactions.

Using its tools, the police were able to trace stolen funds, identify illicit activity, and investigate numerous cryptocurrency-related crimes. It is considered a rather important organization in the crypto cybersecurity chain because it provides much of the intelligence infrastructure that helps authorities and businesses understand who is moving crypto and where.

At this moment, we don’t know if this will result in an extortion attempt. No threat actors have claimed responsibility for this attack, and the data has not yet emerged anywhere on the dark web. Chainalysis has not mentioned being reached out by the attackers or even trying to get in touch with anyone.