On 30 October 2026, the blockchain analytics company Chainalysis disclosed that it had "detected an external actor using offensive agentic techniques" inside its systems and internal tools. At first it said only non-sensitive data, such as user IDs, names, email addresses and role labels, had been accessed, with no evidence that passwords, MFA secrets or session tokens were touched. That picture widened over the following week. On 4 November Chainalysis said an "on-path attack" had exposed a subset of customer passwords, then took its KYT transaction monitoring interface and API, address screening products and login page offline after abnormal activity. Late that night it confirmed that names, usernames, password hashes and live tokens for all Chainalysis users had been exposed, and told every user to reset passwords and rotate API keys. Products were restored behind IP allowlists between 6 and 10 November. Chainalysis has not disclosed how the attacker got in or who it was.
Key takeaways
- Chainalysis disclosed on 30 October 2026 that an external actor using "offensive agentic techniques" accessed its systems and internal tools. It has not explained the phrase.
- The scope grew. Early updates said no session tokens or passwords were accessed; by 4 November Chainalysis confirmed names, usernames, password hashes and live tokens for all users were exposed.
- Some customers' KYT accounts appear to have been accessed without authorisation, according to Chainalysis, which notified them directly. It says there is no evidence investigations data was accessed or attribution data manipulated.
- All users were told to reset passwords and rotate API keys, and restored products now require customers to register trusted IP addresses for an allowlist.
- The identity lesson: live tokens and API keys are bearer credentials that bypass passwords and MFA. When a platform's token store is exposed, every customer integration must be rotated, not just every password.
At a glance
| Organisation | Chainalysis, a blockchain data and investigations platform whose users include law enforcement and national security clients, and all of its users |
|---|---|
| When | First disclosed 30 October 2026; scope widened 4 November 2026; services restored 7 to 10 November 2026. Chainalysis has not given a start date |
| Attacker | Unidentified. Chainalysis describes "an external actor using offensive agentic techniques" and an "ongoing multifront cyberattack"; it has not named a group or tool |
| Entry point | Not disclosed. Chainalysis separately reports an on-path attack that exposed a subset of customer passwords and says that vector was remediated |
| Identities abused | Live tokens and password hashes for all users; customer API keys (rotation required); some customer KYT accounts accessed without authorisation |
| Impact | Names, usernames, password hashes and live tokens for all users exposed; a subset of plaintext passwords intercepted; Reactor, Data Solutions, KYT, address screening and login taken offline for days. No evidence investigations data was accessed, per Chainalysis |
| Category | Agentic AI and AI agents; NHI. Incident class: confirmed AI-agent breach (attacker used agentic techniques, as described by Chainalysis; tokens and keys exposed) |
What happened
Chainalysis sells blockchain analytics used for crypto investigations and compliance. Its Reactor investigations tool, KYT (Know Your Transaction) monitoring service and address screening products are used by exchanges, financial institutions and public agencies, many of which connect through APIs. On 30 October 2026 the company published a security notice and emailed customers. It said it had "detected an external actor using offensive agentic techniques" that accessed its systems and internal tools. The data it then believed was accessed was limited to user IDs, full names, email addresses and organisation role labels. It said there was no evidence of access to investigation content, query results, clear-text passwords, MFA secrets or session tokens, and asked customers to be wary of unexpected password resets and to enable two-factor authentication.
On 2 November Chainalysis took Reactor and Data Solutions offline as a precaution while KYT stayed up. On the morning of 4 November it reported that an "on-path attack", in which an attacker sits between a user and a service and intercepts traffic, had exposed a subset of customer passwords. Those accounts were locked and passwords had to be reset. Within the hour, after what it called abnormal activity, it also took the KYT interface and API, other address screening products and the login page offline, which meant password resets were temporarily impossible. Late on 4 November it published the update that changed the scale of the incident: names, usernames, password hashes and live tokens for all Chainalysis users had been exposed to a malicious actor. Customers whose KYT accounts appeared to have been accessed without authorisation were contacted directly, and all users were told to reset passwords and rotate API keys.
The Record reported on 5 November that Chainalysis told customers the attack was part of "an industry-wide rise in AI-driven cyberattacks" and described "an ongoing multifront cyberattack". The Record notes that the company had not explained what "live tokens" are, how passwords were hashed, or whether the interception, the token exposure and the KYT account access were connected, and that a spokesperson could share nothing beyond the blog post. The Hacker News reported that Chainalysis said the attack resembled those hitting "many other tech platforms in recent weeks". Chainalysis has not named ARTEX, the AI offensive framework linked to several late October intrusions, and this page does not assume a link.
Restoration followed a stricter model. From 6 November KYT and address screening came back in phases, and customers had to submit trusted IP addresses for an allowlist, then reset passwords and rotate API keys before registering transactions. Reactor, KYT and address screening were back on 7 November "with enhanced security measures", in Chainalysis's words, and Data Solutions on 10 November. Throughout, Chainalysis said it had "no evidence that any investigations data has been accessed" and no evidence that attribution data was manipulated.
Timeline
| Date | Event |
|---|---|
| 30 October 2026 | Chainalysis discloses an intrusion by an external actor using offensive agentic techniques; says only non-sensitive user data was accessed. |
| 2 November 2026 | Reactor and Data Solutions taken offline as a precaution; KYT remains online. |
| 4 November 2026 | On-path attack exposes a subset of passwords; KYT, address screening and login taken offline; late update confirms names, usernames, password hashes and live tokens for all users exposed. |
| 5 November 2026 | The Record reports the widened scope and that Chainalysis cannot say more than its blog. |
| 6 November 2026 | Phased restoration of KYT and address screening begins behind customer IP allowlists. |
| 7 November 2026 | Reactor, KYT and address screening restored with enhanced security measures. |
| 10 November 2026 | Data Solutions restored. |
How it happened: the identity attack path
- Initial access, not disclosed. Chainalysis has not said how the attacker first reached its systems and internal tools, only that the actor used offensive agentic techniques.
- Internal tools and user data reached. The attacker accessed internal tools and user records, initially reported as IDs, names, emails and role labels.
- Passwords intercepted in transit. An on-path attack exposed a subset of customer passwords as users signed in. Chainalysis says this vector was later addressed.
- Token and hash store exposed. Names, usernames, password hashes and live tokens for all users were exposed. Live tokens can let a holder act as a user without knowing the password.
- Customer accounts accessed. Some customers' KYT accounts appear to have been accessed without authorisation, which Chainalysis treated as grounds to rotate every user's credentials and API keys.
Impact
- Confirmed: Names, usernames, password hashes and live tokens for all Chainalysis users exposed; a subset of customer passwords exposed through an on-path attack; some KYT accounts apparently accessed without authorisation.
- Service disruption: Reactor and Data Solutions offline from 2 November; KYT interface and API, address screening and login offline from 4 November; full restoration by 10 November.
- Not found: Chainalysis says there is no evidence that investigations data was accessed or attribution data manipulated. It has not published a count of affected KYT accounts.
- Customer burden: Every user must reset passwords and rotate API keys, and restored access depends on registering trusted IP addresses.
- Potential: Exposed hashes may be crackable depending on the hashing method, which Chainalysis has not disclosed, and any unrotated API key or token remains usable by whoever holds it.
What this means for NHI and AI agent security
Chainalysis is on this list because the most serious exposure was not passwords but tokens and API keys, the credentials that customer systems use to call KYT and screening APIs without a person present. Those are non-human identities owned by customers but stored and validated by Chainalysis. A live token or API key is a bearer credential: whoever has it can use it, and MFA does not apply. That is why Chainalysis could not fix this with password resets alone and asked for API key rotation and IP allowlisting. It also used the phrase "offensive agentic techniques" to describe the attacker, and placed the incident within an industry-wide rise in AI-driven attacks, which puts it alongside other late October and November platform incidents such as Chainstack and GitBook.
The general lesson is about blast radius and honest scoping. The first notice said no session tokens were accessed; five days later every user's tokens were in scope. That is common when investigations move fast, and it is why platforms should be able to revoke all customer tokens and force key rotation quickly, ideally without taking whole products offline. Our API Key Management Guide covers short-lived and IP-bound keys, and the Session Token Theft Response Playbook covers mass revocation.
For customers, the incident shows the value of a register of every third-party credential your systems hold. Organisations that knew exactly where their Chainalysis API keys were used could rotate in hours. Those that did not had to hunt for them while their compliance monitoring was offline.
Recommendations
- Rotate every Chainalysis credential. If you use Chainalysis, reset passwords, rotate all API keys and confirm that old keys and tokens no longer work. See our Leaked Credential Response Playbook.
- Bind API keys to network and scope. Restrict platform API keys to known IP ranges and the minimum permissions, as Chainalysis now requires through allowlists. See our API Key Management Guide.
- Keep tokens short-lived and revocable. Platforms should issue short-lived tokens and be able to revoke all of them at once without a full outage. See our Session Token Theft Response Playbook.
- Keep a register of third-party credentials. Record which vendor keys and tokens you hold, where they are stored and who owns them, so rotation after a supplier breach is fast. See our OWASP NHI Top 10 NHI3 Vulnerable Third-Party NHI Guide.
- Use password reset links with care. Follow Chainalysis's advice to sign in through the login page directly rather than links in emails, as breach notices attract phishing.
- Monitor API use for abnormal patterns. Watch for calls from new locations, unusual volumes or unfamiliar user agents on vendor integrations, which is how agent-driven abuse tends to show up. See our ITDR Guide.
Frequently asked questions
What was exposed in the Chainalysis breach?
Chainalysis says names, usernames, password hashes and live tokens for all its users were exposed, and that a subset of customer passwords was exposed through an on-path attack. Some customers' KYT accounts appear to have been accessed without authorisation. Chainalysis says it has no evidence that investigations data was accessed or that attribution data was manipulated.
What does "offensive agentic techniques" mean in the Chainalysis incident?
Chainalysis has not explained the phrase. It generally refers to AI agents that plan and carry out reconnaissance and exploitation with little human input. Chainalysis linked the attack to an industry-wide rise in AI-driven cyberattacks but has not named a tool, model or threat group.
What should Chainalysis customers do?
Chainalysis asked all users to reset their passwords and rotate API keys as applicable, and to submit trusted IP addresses so access can be allowlisted. It also advised signing in through its login page directly rather than via links in emails. Organisations should also check logs for unexpected use of their Chainalysis accounts and keys.
Related NHI Mgmt Group resources
Chainstack breach 2026 · GitBook breach 2026 · WorkOS breach 2026 · API Key Management Guide · Session Token Theft Response Playbook
How NHI Mgmt Group can help
When a platform's token store is exposed, the hardest part is often finding every place its keys are used. NHI Mgmt Group helps organisations build registers of third-party credentials, design rotation that can run in hours rather than days, and prepare for agent-driven attacks that move faster than manual response. See our NHI and AI agent security training.
References
- Chainalysis: Updated Nov 10: Chainalysis Security Incident Information (30 October 2026)
- The Hacker News: Chainstack Reports Production Systems Breach Exposing Customer Data and Password Hashes (3 November 2026)
- The Record: Chainalysis warns all users hit in cyber breach involving 'agentic' techniques (5 November 2026)
- The Hacker News: Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services (6 November 2026)