# SZB-fa6a588ebd: Chainalysis says attack exposed user credentials and live tokens

Chainalysis says its ongoing investigation into an agentic cyber attack on its systems found that names, usernames, password hashes and live tokens were exposed for all users.

- Type: Breach
- Status: Confirmed
- Vendor: Chainalysis
- Product: KYT
- Disclosed: 2026-11-05 18:54 UTC
- Data taken: Names, Password hashes, Email addresses, Tokens and keys
- Sources: 18 distinct
- First seen by cve.now: 2026-11-05 22:58 UTC · Updated: 2026-11-06 23:20 UTC

Written by a model from the sources below. Verify against them.

## Summary

The company says it removed access to Reactor and Data Solutions while investigating and that it has no evidence investigation data was accessed.

## What to do

- Change your password there and anywhere you reused it, and turn on multi-factor authentication · For password hashes
- Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it · For tokens and keys
- Expect phishing that uses this breach; verify messages that mention it · For email addresses
- Reset your Chainalysis password and any password reused elsewhere
- Revoke and reissue any Chainalysis API keys or live tokens
- Enable multi-factor authentication on your Chainalysis account
- Rotate any Chainalysis API keys, passwords, and integration credentials now
- Review Chainalysis account and API access logs for unfamiliar activity

## Timeline

- 2026-11-05 18:54 UTC: Made public by The Hacker News
- 2026-11-05 22:58 UTC: First seen by cve.now
- 2026-11-06 14:17 UTC: Confirmed by Chainalysis. BleepingComputer: “Blockchain intelligence firm Chainalysis says a recent attack on its systems and internal tools has exposed credentials and live tokens for all customers.” ([source](https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/))
- 2026-11-06 23:20 UTC: Record last updated

## What was taken

- Names, Password hashes: [The Hacker News](https://thehackernews.com/2026/11/chainalysis-breach-exposes-all-users.html): “Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users.”
- Email addresses: [Mastodon](https://mastodon.social/@Analyst207/117565350976318290): “A recent Chainalysis breach has raised security concerns, exposing sensitive information including usernames, password hashes, live tokens, and personal data such as user IDs, full names, and email addresses.”
- Tokens and keys: [BleepingComputer](https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/): “On Monday, we discovered certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor," it said in a Wednesday update.”

## Evidence (18 sources)

- 2026-11-05 · Social · [Mastodon](https://mastodon.social/@Analyst207/117565350976318290): “A recent Chainalysis breach has raised security concerns, exposing sensitive information including usernames, password hashes, live tokens, and personal data such as user IDs, full names, and email addresses.”
- 2026-11-05 · Social · [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzlxpuak2s26): “Blockchain intelligence company Chainalysis has significantly expanded its assessment of a…” (+6 more: [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mznm6hya6q2y), [Bluesky](https://bsky.app/profile/techrad.ar/post/3mznp32pu4u2e), [Bluesky](https://bsky.app/profile/defimarketjournal.com/post/3mzobs7hgyf2u), [Bluesky](https://bsky.app/profile/infosecbriefly.bsky.social/post/3mzoepa6l6t25), [Bluesky](https://bsky.app/profile/privpros.bsky.social/post/3mzoeqhb3pm2t), [Bluesky](https://bsky.app/profile/eudatabriefly.bsky.social/post/3mzoeqizpw72j))
- 2026-11-06 · Social · [Bluesky](https://bsky.app/profile/blockchainreport.bsky.social/post/3mzmjxiulgc2l): “Chainalysis confirms major data breach: Usernames, password hashes, auth tokens, and some plain-text passwords exposed.” (+6 more: [Bluesky](https://bsky.app/profile/cryptonews-poster.bsky.social/post/3mzmsyi3itr26), [Bluesky](https://bsky.app/profile/newisty.com/post/3mzmwnic6aq2z), [Bluesky](https://bsky.app/profile/newssecia.bsky.social/post/3mzmziauw7i2k), [Bluesky](https://bsky.app/profile/cysecuritynews.bsky.social/post/3mznkws6wk52o), [Bluesky](https://bsky.app/profile/cybernewsph.com/post/3mznmiqzg3y2v), [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzobbybywi22))
- 2026-11-06 · Social · [Bluesky](https://bsky.app/profile/coincourier.bsky.social/post/3mzmt22uwjd24): “Chainalysis Updates Breach Scope to All User Data”
- 2026-11-06 · Social · [Bluesky](https://bsky.app/profile/gazewires.bsky.social/post/3mzmtztho572l): “Chainalysis says a cyber intrusion exposed password hashes and live tokens, while its investigation and attribution data remain intact.”
- 2026-11-06 · Press · [The Hacker News](https://thehackernews.com/2026/11/chainalysis-breach-exposes-all-users.html): “Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users.”
- 2026-11-06 · Social · [Mastodon](https://mastodon.social/@newisty/117568481499004803): “Chainalysis revealed that a cyberattack initially thought to be minor actually exposed password hashes and live tokens for all of its platform users.” (+2 more: [Mastodon](https://infosec.exchange/@cyberseckyle/117570025021744853), [Mastodon](https://mastodon.social/@burso/117570340008241043))
- 2026-11-06 · Social · [Mastodon](https://mastodon.social/@Analyst207/117568650542370803): “A recent cyber attack on Chainalysis has compromised user credentials, forcing the company to shut down key services and lock affected accounts while it strengthens its security measures.”
- 2026-11-06 · Social · [Mastodon](https://infosec.exchange/@cloud/117568679805032858): “Chainalysis breach: names, usernames, password hashes and live API tokens for all users exposed, found while investigating an "agentic" intrusion.”
- 2026-11-06 · Social · [Mastodon](https://infosec.exchange/@cyberworldops/117568822031043185): “Chainalysis says an attack exposed credentials for all users and forced key services offline.”
- 2026-11-06 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/): “Blockchain intelligence firm Chainalysis says a recent attack on its systems and internal tools has exposed credentials and live tokens for all customers.” (+1 more: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mznl4v5bjc2k))
- 2026-11-06 · Social · [Mastodon](https://mastodon.social/@Analyst207/117569949355224143): “A shocking data breach at blockchain intelligence firm Chainalysis has exposed sensitive customer credentials, including names, usernames, and password hashes, to a malicious actor, putting users worldwide at risk.”
- 2026-11-06 · Social · [Bluesky](https://bsky.app/profile/gazewires.bsky.social/post/3mznm4natws2r): “Chainalysis confirms cyber incident exposing credentials for all users.”
- 2026-11-06 · Social · [Mastodon](https://infosec.exchange/@security_crawler_carl/117570241860122527): “Reset your passwords and rotate your API keys the moment Chainalysis restores access — follow their official recovery instructions, not whatever your guild is yelling in chat.”
- 2026-11-06 · Social · [Hacker News](https://news.ycombinator.com/item?id=50394387): “Chainalysis says breach exposed password hashes and live tokens”
- 2026-11-06 · Social · [Hacker News](https://news.ycombinator.com/item?id=50398553): “Chainalysis says hackers stole credentials and tokens for all of its customers”
- 2026-11-06 · Social · [Bluesky](https://bsky.app/profile/loopwire.news/post/3mzodxgm64r2t): “The blockchain analytics firm trusted by governments and crypto exchanges worldwide disclosed that attackers made off with login data and access tokens…”
- 2026-11-06 · Social · [Mastodon](https://infosec.exchange/@security_crawler_carl/117572046192955427): “https:// arstechnica.com/security/2026/ 11/chainalysis-says-hackers-stole-credentials-and-tokens-for-all-of-its-customers/”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-fa6a588ebd&body=https%3A%2F%2Fcve.now%2FSZB-fa6a588ebd%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about the Chainalysis breach

### Was Chainalysis breached?

Yes. Chainalysis says so: “Blockchain intelligence firm Chainalysis says a recent attack on its systems and internal tools has exposed credentials and live tokens for all customers.” (BleepingComputer).

Source: https://www.bleepingcomputer.com/news/security/chainalysis-says-breach-exposed-credentials-for-all-customers/

### What data was exposed?

Names, Password hashes, Email addresses, Tokens and keys.

### What should Chainalysis customers do?

Change your password there and anywhere you reused it, and turn on multi-factor authentication. Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it. Expect phishing that uses this breach; verify messages that mention it. Reset your Chainalysis password and any password reused elsewhere. Revoke and reissue any Chainalysis API keys or live tokens. Enable multi-factor authentication on your Chainalysis account. Rotate any Chainalysis API keys, passwords, and integration credentials now. Review Chainalysis account and API access logs for unfamiliar activity.

## Related

- Started as early warning SZB-fa6a588ebd, first seen 2026-11-05 22:58 UTC
- Browse: [Breaches](https://cve.now/breaches.md) · [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-fa6a588ebd
Site guide for agents: https://cve.now/llms.txt