---
title: "Chainalysis: all users’ live tokens exposed, five days after “no evidence”"
summary: "What Chainalysis said in its own incident post from 30 October to 10 November: what was exposed, when it found out, and how long Reactor and Data Solutions stayed offline."
url: https://www.thetechbag.com/blog/chainalysis-all-users-data-tokens-exposed
format: Note
desk: "Security"
area: "Identity & access"
region: Global
published: 2026-11-10
facts_checked: 2026-11-10
author: TechBag (The TechBag Journal)
tags: ["Chainalysis","Reactor","KYT","session tokens","password hashes","API keys","credential reset","agentic attacks","crypto compliance","incident disclosure"]
cover: https://www.thetechbag.com/blog/covers/chainalysis-all-users-data-tokens-exposed.png
---

# Chainalysis: all users’ live tokens exposed, five days after “no evidence”

*What Chainalysis said in its own incident post from 30 October to 10 November: what was exposed, when it found out, and how long Reactor and Data Solutions stayed offline.*

Note · Security · Identity & access · By TechBag · Published 2026-11-10 · Facts checked 2026-11-10 · Canonical: https://www.thetechbag.com/blog/chainalysis-all-users-data-tokens-exposed

Chainalysis, the crypto-tracing company whose software is sold to police forces, tax agencies and regulators, said late on 4 November that “names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor”.[1][2] Five days earlier the same incident post had said it had “found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens”.[1] Data Solutions, the last product it took down, came back only at 3am US Eastern time on 10 November.[1]

## How the account changed

**Figure: Chainalysis moved from “no evidence” on tokens to “all users” in five days, and its last product returned on 10 November**

*Statements in Chainalysis’s incident post, 30 October to 10 November, on the dates it stamped them (US Eastern time)*

| Date | Event | Detail |
| --- | --- | --- |
| 30 Oct 2026 | “No evidence” tokens were accessed | User IDs, full names, email addresses and role labels were accessed |
| 2 Nov 2026 | Reactor and Data Solutions offline | KYT, the transaction-screening product, kept running; the exposure of all users was discovered this day |
| 4 Nov 2026 | Some passwords exposed; KYT offline | Passwords exposed in an “on-path attack”; KYT, address screening and the login page taken down after abnormal activity |
| 4 Nov 2026 | All users’ live tokens exposed | Also names, usernames and password hashes |
| 6 Nov 2026 | KYT and screening return in phases |  |
| 7 Nov 2026 | Reactor, KYT and screening back |  |
| 10 Nov 2026 | Data Solutions back online |  |

Source: Chainalysis incident post · as of 10 November 2026

On 30 October Chainalysis told customers an “external actor” had used “offensive agentic techniques” to reach its systems and internal tools, and that the data accessed was “non-sensitive”: user IDs, full names, email addresses and role labels.[1] It has not explained that phrase, or how the intruder got in. It says the incident is unrelated to the theft at Binance.[1] By 2 November it had taken Reactor, its investigations tool, and Data Solutions offline, while keeping its transaction screening running because of “their role in detecting money laundering”.[1]

That choice lasted two days. On 4 November, after “abnormal activity”, it took KYT and the address-screening products offline along with the login page, and said it was notifying customers “whose KYT accounts appear to have been accessed without authorization”.[1] Separately, an “on-path attack” had exposed a subset of customer passwords, which it says it has contained.[1]

## Why a live token is the line that matters

A password hash has to be cracked before it is any use, and changing the password defeats it. A session token is what a service hands you after you have signed in, so whoever holds a live one has no password to guess and no second factor to pass. OWASP’s guidance puts it this way: once a session exists, the token “is temporarily equivalent to the strongest authentication method used by the application”.[3] The 30 October email listed multi-factor secrets among the things not accessed; a live token does not need them.[1]

The conditions for coming back show how seriously the company took that. Customers had to send trusted IP addresses for an allowlist, and every user had to reset a password and rotate API keys before registering transactions.[1] Reactor and the screening products returned on 7 November with what the company calls enhanced security measures.[1]

## What is still unknown, and what to do

The statement investigators will weigh is this one: as of 4 November Chainalysis had “no evidence that any investigations data has been accessed”, nor that the address labels investigators rely on had been altered.[1] It has not said how many users there are; its site claims more than 1,500 connected organisations.[2]

If you use Chainalysis, the company’s own instructions apply: reset the password, rotate API keys, and change that password anywhere else you reused it.[1] If you use any other software-as-a-service tool and receive a notice like the one of 30 October, ask three things: were session tokens and API keys in scope, or only passwords; have they been revoked; and on what date was the “no evidence” finding made. Rotate your own keys when the notice arrives, without waiting for the answers.

How we did this

Figures as of 10 November 2026, 7:30pm IST

Everything about the incident is Chainalysis’s own account, from the one post it has updated since 30 October, and nobody outside the company has confirmed it. Dates and times are as the post stamps them, in US Eastern time; the latest update is 3am on 10 November. Five days is the gap between its statements of 30 October and 4 November; the post says the exposure was discovered on 2 November. Customer groups are from Chainalysis’s website. The explanation of session tokens is ours, with OWASP’s wording quoted.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [Chainalysis, Updated Nov 10: Chainalysis Security Incident Information (updates of 30 October, 2, 4, 6, 7 and 10 November)](https://www.chainalysis.com/blog/security-incident-october-30/) — 30 October to 10 November 2026
2. [Chainalysis, Law Enforcement Blockchain Intelligence (customer groups; 1,500+ organisations connected)](https://www.chainalysis.com/law-enforcement/) — undated page
3. [OWASP, Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) — undated page

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

**Read this next:** [WorkOS breached by an escaped AI agent: four gaps, five days unseen](https://www.thetechbag.com/blog/workos-breached-by-escaped-ai-agent) — Another intrusion by an AI agent: how a researcher’s agent left its test sandbox, and the four gaps that let it into a sales tool.

Go deeper on TechBag

- [IAM, SSO and MFA guide](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) — sign-in controls, and what happens to a session after the sign-in
- [Privileged access management guide](https://www.thetechbag.com/browse/identity-access/privileged-access-management) — controls on the accounts and keys that reach internal tools
- [SIEM and log management guide](https://www.thetechbag.com/browse/security/siem-log-management) — spotting a live session used from the wrong place