--- title: Chainalysis breach exposed usernames, password hashes... description: Chainalysis now says a breach exposed usernames, password hashes and live authentication tokens for every customer. The company first described the incident as... canonical: https://daily.dev/posts/chainalysis-breach-exposed-usernames-password-hashes-and-live-tokens-for-all-customers-4rhczurgn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Chainalysis breach exposed usernames, password hashes and live tokens for all customers | daily.dev og:description: Chainalysis now says a breach exposed usernames, password hashes and live authentication tokens for every customer. The company first described the incident as... og:url: https://daily.dev/posts/chainalysis-breach-exposed-usernames-password-hashes-and-live-tokens-for-all-customers-4rhczurgn og:image: https://api.daily.dev/og/posts/4rhCZUrgN.png og:image:alt: Chainalysis breach exposed usernames, password hashes and live tokens for all customers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Chainalysis breach exposed usernames, password hashes and live tokens for all customers **[Collections](https://daily.dev/sources/collections)** · 2 min read · 0 upvotes · 0 comments ## Summary Chainalysis now says a breach exposed usernames, password hashes and live authentication tokens for every customer. The company first described the incident as involving 'offensive agentic techniques' exposing only non-sensitive metadata like names and emails. It later revised this to an on-path (attacker-in-the-middle) attack that captured credentials for all customers, with the company implying the attackers used an AI agent and one report dating the intrusion to October. Chainalysis took its login portal, Reactor, Data Solutions, KYT and Address Screening offline, and plans to restore KYT and Address Screening on November 5 with IP allowlisting. Every user will have to reset passwords and rotate API keys as appropriate when service returns. ## Content Chainalysis has said an attack on its systems exposed usernames, password hashes and live authentication tokens for every customer. That is a lot worse than what the company first reported. The initial disclosure described the incident as involving "offensive agentic techniques" and said only non-sensitive identity metadata was exposed: user IDs, names, email addresses and role labels. Later updates changed the picture. Chainalysis now says an on-path attack, also called attacker-in-the-middle or MITM, captured credentials for all customers. The company has implied the attackers used an AI agent. One report dates the intrusion to October. Chainalysis detected abnormal activity on its transaction screening products and took several services offline: the login portal, Reactor, Data Solutions, KYT and Address Screening. It plans to restore KYT and Address Screening on November 5, with access limited through IP allowlisting. When service returns, every user will have to reset their password and rotate API keys as appropriate. Anyone who reused a Chainalysis password elsewhere should change it there too. I find the shift in the company's account the most telling part. A breach that begins as "just names and emails" and ends as "password hashes and live tokens for everyone" is a reminder of how early incident statements tend to understate things. For a firm whose customers include law enforcement and compliance teams, live tokens in an attacker's hands are a serious problem. ## Questions this post answers ### What data was exposed in the Chainalysis breach? Usernames, password hashes and live authentication tokens were exposed for every Chainalysis customer. The company initially said only non-sensitive identity metadata like user IDs, names, email addresses and role labels was exposed, but later revised this after determining an on-path (attacker-in-the-middle) attack had captured credentials for all customers. _Teams relying on Chainalysis for compliance workflows can track breach updates like this on daily.dev._ ### When will Chainalysis KYT and Address Screening services be restored after the breach? Chainalysis plans to restore KYT and Address Screening on November 5, with access limited through IP allowlisting. The login portal, Reactor, Data Solutions, KYT and Address Screening were all taken offline after abnormal activity was detected on the company's transaction screening products. _Compliance teams tracking the restoration timeline can follow coverage of incidents like this on daily.dev._ ### What should I do if I had a Chainalysis account during the breach? Every user must reset their password and rotate API keys as appropriate once Chainalysis services come back online. Anyone who reused their Chainalysis password on other sites should change it there too, since password hashes and live authentication tokens were exposed for all customers. _Developers responding to credential-exposure incidents can stay on top of similar advisories via daily.dev._ ## Similar posts on daily.dev - [LastPass says hackers stole customer data through a supply chain breach at Klue](https://daily.dev/posts/lastpass-says-hackers-stole-customer-data-through-a-supply-chain-breach-at-klue-cot1tyrco) · The Next Web · 0 upvotes · 0 comments - [LastPass confirms data breach in Klue supply chain attack](https://daily.dev/posts/lastpass-confirms-data-breach-in-klue-supply-chain-attack-vv50ily4v) · BleepingComputer · 6 upvotes · 4 comments - [LexisNexis Legal & Professional confirms data breach](https://daily.dev/posts/lexisnexis-legal-professional-confirms-data-breach-zcir7glbd) · The Register · 0 upvotes · 0 comments - [Lunar Cyber Launches Token Exposure Monitoring as Infostealers Target Developer and AI Credentials](https://daily.dev/posts/lunar-cyber-launches-token-exposure-monitoring-as-infostealers-target-developer-and-ai-credentials-clbuv0fc0) · DevOps.com · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/chainalysis-breach-exposed-usernames-password-hashes-and-live-tokens-for-all-customers-4rhczurgn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Chainalysis breach exposed usernames, password hashes and live tokens for all customers","url":"https://daily.dev/posts/chainalysis-breach-exposed-usernames-password-hashes-and-live-tokens-for-all-customers-4rhczurgn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/chainalysis-breach-exposed-usernames-password-hashes-and-live-tokens-for-all-customers-4rhczurgn"},"datePublished":"2026-11-06T14:20:07.008Z","dateModified":"2026-11-06T14:20:47.183Z","description":"Chainalysis now says a breach exposed usernames, password hashes and live authentication tokens for every customer. The company first described the incident as...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3542253c665c749a0fa5adc9895e811e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3542253c665c749a0fa5adc9895e811e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/chainalysis-breach-exposed-usernames-password-hashes-and-live-tokens-for-all-customers-4rhczurgn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,data-breach","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Chainalysis breach exposed usernames, password hashes and live tokens for all customers"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/chainalysis-breach-exposed-usernames-password-hashes-and-live-tokens-for-all-customers-4rhczurgn#faq","mainEntity":[{"@type":"Question","name":"What data was exposed in the Chainalysis breach?","acceptedAnswer":{"@type":"Answer","text":"Usernames, password hashes and live authentication tokens were exposed for every Chainalysis customer. The company initially said only non-sensitive identity metadata like user IDs, names, email addresses and role labels was exposed, but later revised this after determining an on-path (attacker-in-the-middle) attack had captured credentials for all customers. Teams relying on Chainalysis for compliance workflows can track breach updates like this on daily.dev."}},{"@type":"Question","name":"When will Chainalysis KYT and Address Screening services be restored after the breach?","acceptedAnswer":{"@type":"Answer","text":"Chainalysis plans to restore KYT and Address Screening on November 5, with access limited through IP allowlisting. The login portal, Reactor, Data Solutions, KYT and Address Screening were all taken offline after abnormal activity was detected on the company's transaction screening products. Compliance teams tracking the restoration timeline can follow coverage of incidents like this on daily.dev."}},{"@type":"Question","name":"What should I do if I had a Chainalysis account during the breach?","acceptedAnswer":{"@type":"Answer","text":"Every user must reset their password and rotate API keys as appropriate once Chainalysis services come back online. Anyone who reused their Chainalysis password on other sites should change it there too, since password hashes and live authentication tokens were exposed for all customers. Developers responding to credential-exposure incidents can stay on top of similar advisories via daily.dev."}}]} ```