Chainalysis, a company whose software many crypto businesses use to screen transactions for money laundering, has disclosed a breach it says was carried out with "offensive agentic techniques". Its first notice, on 30 October, said only directory data had been touched and that it had found no evidence of stolen credentials or tokens. By 4 November that had changed. Names, usernames, password hashes and live tokens for all users had been exposed, some passwords had been captured in an "on-path attack", and some customers' screening accounts had been accessed. Its main products were offline for up to five days. This analysis sets out what is confirmed, the timeline from Chainalysis's own updates, what the "agentic" claim does and does not tell us, and what customers should do.
What is affected, and what is not
Status as of Chainalysis's update of 7 November 2026. Chainalysis has not said how many users or organisations it has.
| Item | Status | What is known |
|---|---|---|
| User directory data | Accessed (confirmed, 30 Oct) | User IDs, full names, email addresses and organisation role labels for users provisioned on the platform. |
| Names, usernames, password hashes and live tokens | Exposed for all users (confirmed, 4 Nov) | Chainalysis says it found this on Monday 2 November and disclosed it on 4 November. |
| Some customers' passwords | Exposed (confirmed, 4 Nov) | Captured in an "on-path attack", which Chainalysis says has been contained. Those accounts were locked and must reset their passwords. |
| KYT accounts | Some accessed without authorisation (4 Nov) | Customers whose KYT accounts appear to have been accessed were told individually. |
| Investigation data | No evidence of access, per Chainalysis | Graphs, notes and cases, as of the 4 November update. |
| Attribution data | No evidence of manipulation, per Chainalysis | As of the 4 November update. |
| Link to the Binance theft | Not related, per Chainalysis | Stated in the first notice. |
| Services | Mostly restored (7 Nov) | Reactor, KYT and Address Screening came back on 7 November with extra protections. Data Solutions and Chain (Beta) were not listed as restored. |
If your organisation uses Chainalysis, reset every user's password and rotate every API key it issued, as Chainalysis now requires. Go to the login page directly rather than following links in reset emails, as Chainalysis itself advises, because attackers often follow a breach with fake reset messages. If anyone reused a Chainalysis password elsewhere, change it there too.
How it unfolded
Figure 1. Original graphic built from the updates on Chainalysis's incident page. Times are US Eastern, as published.
Two points stand out. First, the story changed sharply in five days: the 30 October notice found "no evidence of unauthorized access to... authentication credentials, or session tokens", and on 4 November Chainalysis said every user's password hash and live token had been exposed. Second, the attacker was still active after disclosure. Chainalysis took its screening products and login page offline on 4 November because of "abnormal activity" that its new monitoring had found that day.
What "agentic" tells us, and what it does not
Chainalysis says it "detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools", that it has been patching "the exploited vulnerabilities", and that it is "seeing an industry-wide rise in AI-driven cyberattacks". It describes "an ongoing multifront cyberattack". It has not said what the agents did, which vulnerabilities were used, or how it knew the attacker was using agents.
So the claim, for now, is a label rather than evidence. What it is consistent with is the pattern we described in our analysis of AI attack platforms aimed at Japan: automated tooling that probes many weaknesses quickly and keeps going after the first door closes. The practical point does not depend on the label. A fast, persistent attacker turned a "directory data only" incident into a full credential exposure within a week, so the first scoping of an incident should not be the last.
Why a compliance supplier is different
KYT and address screening are, in Chainalysis's words, "compliance transaction monitoring products", used to detect money laundering. That gives this breach three consequences an ordinary SaaS breach does not have. This is our reading, not Chainalysis's:
- Screening stopped. For about two days, from 4 to 6 November, customers could not use KYT through its interface or API. Each customer needs to know what it did with transactions in that gap.
- Integrity matters as much as secrecy. An attacker able to change risk scores or attribution data could hide money moving through a screened business. Chainalysis says it has no evidence of such manipulation, and that is the right question to keep asking.
- The keys live in customers' systems. API keys that connect a business to KYT are stored in that business's own systems. Rotating them is the customer's job, not the supplier's.
The attacker's view
| Step | ATT&CK | What Chainalysis describes |
|---|---|---|
| Exploit internet-facing weaknesses | T1190 Exploit Public-Facing Application | "Exploited vulnerabilities", patched since; not named. |
| Read the platform's user records | T1213 Data from Information Repositories | User IDs, names, emails and role labels, then usernames and password hashes for all users. |
| Take tokens | T1528 Steal Application Access Token | "Live tokens for all Chainalysis users" exposed. |
| Intercept passwords in transit | T1557 Adversary-in-the-Middle | An "on-path attack" exposed a subset of passwords. |
| Use customers' accounts | T1078 Valid Accounts | Some KYT accounts "appear to have been accessed without authorization". |
The defender's view
- Rotate everything the supplier issued, and find where it is stored. Passwords, API keys and any tokens used by your own systems. Search your code, CI settings and secret stores for Chainalysis keys before you rotate them, so that nothing breaks silently.
- Review your account between 2 and 7 November. Check sign-ins, API use and changes to settings or users in that window, and ask Chainalysis for the account activity it saw if you were among those notified.
- Plan for the supplier going dark. Decide now how you would screen transactions for two days without your main tool: a second provider, a manual check for large or high-risk transfers, or a pause.
- Do not let the first scoping stand. Chainalysis's own notices show how far an early "no evidence of credential access" can move. Build your incident updates, and your questions to suppliers, around that.
- Expect follow-on phishing. Exposed names, emails and role labels make convincing lures for password resets and "security updates".
Our response playbook for AI-assisted intrusions sets out the first decisions when an attacker of this kind is inside a supplier.
| Team | Action | Done when |
|---|---|---|
| Third-party Risk | Ask Chainalysis for your account's activity log, the data exposed for your users, and its final findings | Written answers received |
| IT Operations | Reset passwords, rotate API keys, register trusted IPs, enforce two-step verification | Old keys revoked; all users reset |
| SIEM | Alert on use of Chainalysis credentials from outside your registered addresses | Rule live, or the gap recorded |
What remains unknown
- What the "agentic techniques" were, and how Chainalysis identified them.
- Which vulnerabilities were exploited, and in which systems.
- Where the on-path attack happened, and how many passwords it captured.
- How many users and organisations were affected, and how many KYT accounts were accessed.
- Whether the exposed tokens were used, and whether Data Solutions and Chain (Beta) have returned.
Chainalysis says this incident is unrelated to the Binance theft we covered in our analysis of North Korea's fake recruiters and applicants.
Sources and updates
- Chainalysis: Chainalysis Security Incident Information, updated 30 October to 7 November 2026
- The Record: Chainalysis warns all users hit in cyber breach involving "agentic" techniques
- Infosecurity Magazine: Chainalysis warns customers after "offensive agentic" attack
- The Hacker News: Chainalysis breach exposes all users' credentials, 6 November 2026
- MITRE ATT&CK: T1190 · T1213 · T1528 · T1557 · T1078
9 November 2026: first published. We read every update on Chainalysis's incident page and checked the main points against The Record, Infosecurity Magazine and The Hacker News. The 6 and 7 November restoration updates appear only on Chainalysis's page so far. Quotations are from Chainalysis's page. We will update this analysis if Chainalysis publishes its findings.