[REVISION HISTORY]

Chainalysis cybersecurity breach

3 recorded revisions of this situation.

What changed

2026-11-07 18:21 UTC → 2026-11-08 00:41 UTC · added ~~removed~~

In late October 2026, blockchain intelligence firm Chainalysis disclosed a cybersecurity incident involving the use of offensive agentic AI to gain unauthorized access to internal systems. Initial reports indicated that the breach exposed non-sensitive customer information, such as names, email addresses, and user IDs, but the company stated there was no evidence that investigation content or authentication credentials had been compromised. By early November, the scope of the breach expanded. Chainalysis reported that an “on-path attack” had exposed password hashes and live tokens for all users on its platform. The company also detected abnormal activity on its Know Your Transaction (KYT) platform. In response to these findings, several products, including Reactor, Data Solutions, and Chain (Beta), were taken offline. As of November 7, the firm has confirmed that the breach compromised the credentials, password hashes, and active tokens of its entire client base. This includes high-profile institutional clients such as the FBI, U.S. Immigration and Customs Enforcement (ICE), the U.S. Air Force, Microsoft, Coinbase, and Barclays. While Chainalysis previously described the stolen information as non-sensitive, the theft of active tokens is significant, as these tokens function as digital keys that could allow unauthorized actors to impersonate federal agencies or corporate entities within the platform until they are revoked. ~~The incident highlights~~ Following the mitigation of the attack vector, Chainalysis has begun a ~~potential single point~~ phased restoration of ~~failure for multiple federal agencies~~ its KYT and ~~financial institutions that rely on~~ address-screening products. To facilitate the ~~firm for risk assessment~~ return to service, the company is working with clients to add trusted IP addresses to an allowlist and ~~investigative data.~~ has advised customers to rotate API keys and prepare for password resets. The firm maintains it has no evidence that investigation content was accessed or that its attribution data was manipulated.

Versions

Select a version to see what changed compared to the one before it.