- Published on
Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services
- Authors
- Name
- DeepHorus
Chainalysis has disclosed that a cyberattack exposed names, usernames, password hashes and live tokens for all of its users. The blockchain analysis firm also removed access to key services while it investigates the incident. The company said its probe into the agentic attack is continuing.
Chainalysis removed access to Reactor and Data Solutions. It took the Know Your Transaction interface and API offline, along with address screening and the login page. The firm added monitoring and said it found no evidence that investigation data was accessed or attribution data manipulated.
The disclosure came less than a week after Chainalysis reported an ongoing multi-front cyber attack. An external actor used offensive agentic techniques to gain unauthorized access to systems and internal tools. An on-path attack exposed a subset of customer passwords, though the firm said the vector has been addressed.
Out of caution, Chainalysis locked the impacted accounts. It warned customers who received password-reset emails that resetting is not possible right now. Where necessary, it encouraged users to reset reused credentials on other systems.
The company plans to restore KYT and Address Screening first. Customers must provide trusted IP addresses for an allowlist, then reset passwords and rotate API keys. Chainalysis said it is working around the clock to harden systems and bring Reactor and Data Solutions back online.
It is unclear who is behind the attack. Chainalysis said it resembles incidents at many other tech platforms. Chainstack, OpenCode, Warp and WorkOS disclosed AI-driven attacks, some involving autonomous penetration-testing tool ARTEX.
Microsoft said threat actors use an agentic AI framework to scan GitHub repositories for exposed secrets. In one case, an AI agent progressed from scanning GitHub to exfiltrating Azure Key Vault data in five minutes. Microsoft assessed the activity as ongoing from August 2026, with sign-ins from two IP addresses.
