News Desk · Crypto crime

Chainalysis says breach exposed password hashes and live tokens for all users, takes KYT and address screening offline

Blockchain analytics firm Chainalysis said an attack using "offensive agentic techniques" exposed names, usernames, password hashes and live tokens for all users. It took KYT, address screening, Reactor and Data Solutions offline and is restoring KYT and address screening in phases.

Developing storyCrypto crimeGlobal6 Nov 20263 min readUpdated 6 Nov 2026

Chainalysis disclosed on Friday, 30 October 2026 that it had been the target of a cybersecurity incident. In an email to customers quoted in its incident post, the company said an external actor used "offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools." At that point it said the data accessed was limited to user IDs, full names, email addresses and organisation role labels, that it had no evidence of access to investigation content, passwords or session tokens, and that the incident was not related to the recent crypto theft at Binance. It said it had engaged third-party cybersecurity experts.

The company widened that assessment in later updates. On Monday, 2 November it took Reactor and Data Solutions offline "out of an abundance of caution", while its compliance transaction monitoring products kept running. On 4 November it said an "on-path attack" had exposed a subset of customer passwords, then took KYT (both the interface and the API), its other address screening products and the login page offline after detecting abnormal activity. In an update late on 4 November, Chainalysis said it had discovered that names, usernames, password hashes and live tokens for all users had been exposed to a malicious actor. It said customers whose KYT accounts appeared to have been accessed without authorisation were being notified directly.

Chainalysis said it has "no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated." It has not said who carried out the attack.

In its update on 6 November, Chainalysis said access to KYT and Address Screening was being restored in phases. Customers must send trusted IP addresses to Chainalysis support or their account team for allowlisting, and must reset passwords and rotate API keys before registering transactions. Reactor and Data Solutions remained offline while the company works with external security experts.

This account is based on the company's own public statements and on-chain analysis by a blockchain intelligence firm, as reported by the sources below. No regulator or government agency had published a statement when it was written. Figures may change as investigations continue.

Why it matters to AML professionals

Many crypto exchanges, banks and payment firms rely on Chainalysis KYT and address screening to monitor crypto transactions and screen wallet addresses, including for sanctions exposure. While those tools are offline, those firms have a gap in an automated control. Compliance teams need a documented fallback for the outage, a plan to review transactions that went unscreened, and a check that API keys and credentials used by their own systems have been rotated.

Red flags in this case

Crypto deposits or withdrawals processed during the outage window without address screening or risk scoring
Backlog of transactions registered for monitoring once KYT access is restored, with alerts generated after funds have already moved
Unexpected logins, API calls or configuration changes on your firm's analytics accounts during the incident period
Phishing emails or calls claiming to be from Chainalysis and asking for passwords, API keys or IP details

If this landed in your queue

Confirm with your team whether your firm uses KYT, address screening or Reactor, and record the dates the tools were unavailable
Follow your outage procedure: apply manual or alternative screening, and consider holding high-risk crypto transfers until screening is back
Once access returns, run back-screening on transactions processed during the outage and escalate any hits under your normal procedures
Make sure passwords are reset and API keys rotated, and report any suspected unauthorised account access to your security team

Key terms

KYT (Know Your Transaction): Chainalysis's transaction monitoring product, which scores crypto transfers for risk based on where the funds come from and go to.
Address screening: Checking a crypto wallet address against risk data such as sanctions designations, hacks, scams and darknet markets before or after a transaction.
On-path attack: An attack where the attacker sits between a user and a service and intercepts or alters traffic, also called a man-in-the-middle attack.

Interview angle

Your firm's crypto transaction monitoring vendor goes offline for several days. What do you do?

Explain that you would follow the outage or business continuity procedure, switch to manual or alternative screening for high-risk activity, document the gap and the decisions taken, back-screen everything processed during the outage once the tool is restored, and escalate any hits under the normal process.

Sources

Go deeper on AMLift

Get the next story in your feedFollow AMLift on LinkedIn for new enforcement breakdowns, the weekly AML challenge and new tools.

Follow on LinkedIn

Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.