# SZB-b6e6ae73e2: Chainalysis says attack exposed credentials and live tokens for all customers

Chainalysis says a recent attack on its systems and internal tools exposed credentials and live tokens for all customers.

- Type: Breach
- Status: Confirmed
- Vendor: Chainalysis
- Disclosed: 2026-11-06 14:17 UTC
- Data taken: Names, Email addresses, Password hashes, Tokens and keys
- Sources: 4 distinct
- First seen by cve.now: 2026-11-07 16:58 UTC · Updated: 2026-11-08 03:10 UTC

Written by a model from the sources below. Verify against them.

## Summary

The item reports this claim from BleepingComputer and does not describe the scope or the attacker.

## What to do

- Change your password there and anywhere you reused it, and turn on multi-factor authentication · For password hashes
- Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it · For tokens and keys
- Expect phishing that uses this breach; verify messages that mention it · For email addresses
- Rotate any Chainalysis API keys, tokens, and passwords now.
- Review recent activity on Chainalysis accounts and integrations for unexpected access.
- Follow Chainalysis's official notices for confirmed scope and remediation steps.
- Enable multi-factor authentication on accounts that connect to Chainalysis.

## Timeline

- 2026-11-06 14:17 UTC: Made public by BleepingComputer on Bluesky
- 2026-11-06 14:17 UTC: Confirmed by Chainalysis. BleepingComputer on Bluesky: “"On Monday, we discovered certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a…” ([source](https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/))
- 2026-11-07 16:58 UTC: First seen by cve.now
- 2026-11-08 03:10 UTC: Record last updated

## What was taken

- Names, Email addresses: [BleepingComputer on Bluesky](https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/): “This follows the company's disclosure last Friday that attackers using AI tools accessed customers' names, email addresses, user IDs, and organizational role labels using what it described as "offensive agentic techniques."”
- Password hashes: [BleepingComputer on Bluesky](https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/): “"On Monday, we discovered certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor," it said in a Wednesday update.”
- Tokens and keys: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mznl4v5bjc2k): “Blockchain intelligence firm Chainalysis says a recent attack on its systems and internal tools has exposed credentials and live tokens for all customers.”

## Evidence (4 sources)

- 2026-11-06 · Press · [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mznl4v5bjc2k): “Blockchain intelligence firm Chainalysis says a recent attack on its systems and internal tools has exposed credentials and live tokens for all customers.”
- 2026-11-06 · Social · [Mastodon](https://infosec.exchange/@security_crawler_carl/117572046192955427): “chainalysis-says-hackers-stole-credentials-and-tokens-for-all-of-its-customers” (+1 more: [Mastodon](https://mastodon.thenewoil.org/@thenewoil/117576814078622069))
- 2026-11-07 · Social · [Hacker News](https://news.ycombinator.com/item?id=50406033): “Chainalysis says breach exposed credentials for all customers”
- 2026-11-07 · Social · [Bluesky](https://bsky.app/profile/sambowne.infosec.exchange.ap.brid.gy/post/3mzqwan37bv62): “Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-b6e6ae73e2&body=https%3A%2F%2Fcve.now%2FSZB-b6e6ae73e2%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about the Chainalysis breach

### Was Chainalysis breached?

Yes. Chainalysis says so: “"On Monday, we discovered certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor," it said in a Wednesday update.” (BleepingComputer on Bluesky).

Source: https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/

### What data was exposed?

Names, Email addresses, Password hashes, Tokens and keys.

### What should Chainalysis customers do?

Change your password there and anywhere you reused it, and turn on multi-factor authentication. Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it. Expect phishing that uses this breach; verify messages that mention it. Rotate any Chainalysis API keys, tokens, and passwords now. Review recent activity on Chainalysis accounts and integrations for unexpected access. Follow Chainalysis's official notices for confirmed scope and remediation steps. Enable multi-factor authentication on accounts that connect to Chainalysis.

## Related

- Started as early warning SZB-b6e6ae73e2, first seen 2026-11-07 16:58 UTC
- Browse: [Breaches](https://cve.now/breaches.md) · [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-b6e6ae73e2
Site guide for agents: https://cve.now/llms.txt