Chainalysis: all users’ live tokens exposed, five days after “no evidence”
What Chainalysis said in its own incident post from 30 October to 10 November: what was exposed, when it found out, and how long Reactor and Data Solutions stayed offline.
Chainalysis, the crypto-tracing company whose software is sold to police forces, tax agencies and regulators, said late on 4 November that “names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor”.12 Five days earlier the same incident post had said it had “found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens”.1 Data Solutions, the last product it took down, came back only at 3am US Eastern time on 10 November.1
01How the account changed
Chainalysis moved from “no evidence” on tokens to “all users” in five days, and its last product returned on 10 November
Statements in Chainalysis’s incident post, 30 October to 10 November, on the dates it stamped them (US Eastern time)
Show tableHide table
| Date | Event | Detail |
|---|---|---|
| 30 Oct 2026 | “No evidence” tokens were accessed | User IDs, full names, email addresses and role labels were accessed |
| 2 Nov 2026 | Reactor and Data Solutions offline | KYT, the transaction-screening product, kept running; the exposure of all users was discovered this day |
| 4 Nov 2026 | Some passwords exposed; KYT offline | Passwords exposed in an “on-path attack”; KYT, address screening and the login page taken down after abnormal activity |
| 4 Nov 2026 | All users’ live tokens exposed | Also names, usernames and password hashes |
| 6 Nov 2026 | KYT and screening return in phases | |
| 7 Nov 2026 | Reactor, KYT and screening back | |
| 10 Nov 2026 | Data Solutions back online |
Source: Chainalysis incident post · as of 10 November 2026
On 30 October Chainalysis told customers an “external actor” had used “offensive agentic techniques” to reach its systems and internal tools, and that the data accessed was “non-sensitive”: user IDs, full names, email addresses and role labels.1 It has not explained that phrase, or how the intruder got in. It says the incident is unrelated to the theft at Binance.1 By 2 November it had taken Reactor, its investigations tool, and Data Solutions offline, while keeping its transaction screening running because of “their role in detecting money laundering”.1
That choice lasted two days. On 4 November, after “abnormal activity”, it took KYT and the address-screening products offline along with the login page, and said it was notifying customers “whose KYT accounts appear to have been accessed without authorization”.1 Separately, an “on-path attack” had exposed a subset of customer passwords, which it says it has contained.1
02Why a live token is the line that matters
A password hash has to be cracked before it is any use, and changing the password defeats it. A session token is what a service hands you after you have signed in, so whoever holds a live one has no password to guess and no second factor to pass. OWASP’s guidance puts it this way: once a session exists, the token “is temporarily equivalent to the strongest authentication method used by the application”.3 The 30 October email listed multi-factor secrets among the things not accessed; a live token does not need them.1
The conditions for coming back show how seriously the company took that. Customers had to send trusted IP addresses for an allowlist, and every user had to reset a password and rotate API keys before registering transactions.1 Reactor and the screening products returned on 7 November with what the company calls enhanced security measures.1
03What is still unknown, and what to do
The statement investigators will weigh is this one: as of 4 November Chainalysis had “no evidence that any investigations data has been accessed”, nor that the address labels investigators rely on had been altered.1 It has not said how many users there are; its site claims more than 1,500 connected organisations.2
If you use Chainalysis, the company’s own instructions apply: reset the password, rotate API keys, and change that password anywhere else you reused it.1 If you use any other software-as-a-service tool and receive a notice like the one of 30 October, ask three things: were session tokens and API keys in scope, or only passwords; have they been revoked; and on what date was the “no evidence” finding made. Rotate your own keys when the notice arrives, without waiting for the answers.
Sources
- Chainalysis, Updated Nov 10: Chainalysis Security Incident Information (updates of 30 October, 2, 4, 6, 7 and 10 November) — 30 October to 10 November 2026
- Chainalysis, Law Enforcement Blockchain Intelligence (customer groups; 1,500+ organisations connected) — undated page
- OWASP, Session Management Cheat Sheet — undated page
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
