Security
Five Days After Saying No Session Tokens Were Touched, Chainalysis Says Every User’s Live Token Was Exposed
Chainalysis, the blockchain-analytics firm whose tools exchanges and investigators rely on, has repeatedly revised its breach notice since October 30. The scope grew from names and emails to credentials for every user. The company says it has no evidence investigation data was touched.
On Friday, October 30, Chainalysis told customers an outside actor had used what it called “offensive agentic techniques” to get into its systems and internal tools. By Saturday, November 7, the same page carried a seven-entry timeline ending with services restored. In between, the description of what was exposed changed twice, and the second change reversed one of the first notice’s reassurances.
This desk read Chainalysis’s notice directly and compared it with The Hacker News’s account of November 6. Where the two differ, or where neither says, this story says so.
What the notice said, in order
The October 30 entry, as the page reads, said that on the evidence then available there was no unauthorized access to investigation content, clear-text passwords, MFA secrets or session tokens. What had been accessed, it said, was non-sensitive: user IDs, full names, email addresses and organization role labels.
One notice, five stages of scope
| When (2026) | What the notice said |
|---|---|
| Oct 30 | User IDs, names, emails, role labels accessed; no passwords, MFA secrets or session tokens |
| Nov 2 | Reactor and Data Solutions taken offline “proactively”; KYT still running |
| Nov 4, 9:50 A.M. EST | A subset of customer passwords exposed in an “on-path attack”; accounts locked |
| Nov 4, 10:30 A.M. EST | KYT (interface and API), address screening and the login page taken offline |
| Nov 4, 11:00 P.M. EST | Names, usernames, password hashes and live tokens exposed for all users |
Put side by side, the entries conflict. The October 30 notice said session tokens had not been accessed; the November 4 entry lists live tokens for every user. The notice does not call this a correction or explain what was learned in between, and this desk cannot say from the page whether the tokens were reachable on October 30 and missed, or became reachable later.
Hashes, tokens, and why the second matters more
A password hash generally has to be cracked before it is useful. A live token is different: depending on how the service issues it, it can let the holder act as the user without any password. The Hacker News makes the same distinction. Chainalysis’s notice does not say how long the exposed tokens stayed valid, or whether any were used. It says only that customers whose KYT accounts “appeared to be accessed without authorization” were notified directly. The number of such accounts is not given.
The interception is a separate piece. The notice says a subset of customer passwords was exposed through an on-path attack, meaning someone sat on the network path between users and the service. Chainalysis says it has contained that vector. It does not say where on the path the attacker sat, or whether the same actor was behind the token exposure.
What stayed offline, and what came back
For several days the company’s transaction-monitoring product, KYT, was down, along with address screening and the login page. KYT is the screening layer many exchanges and fintechs use to flag suspect deposits, so an outage there lands on Chainalysis’s customers’ compliance operations, not just on Chainalysis. The notice does not say how customers screened transactions in the interim.
At 3:30 A.M. EST on November 6, the notice says, KYT and address screening were being restored in phases; customers had to submit trusted IP addresses for an allowlist, and all users had to reset passwords and rotate API keys before registering transactions. By 1:50 P.M. EST on November 7, the notice lists Reactor, KYT and address screening as back online with “enhanced security measures.” Data Solutions was still being hardened as of the November 6 entry, and the Chain (Beta) product was last listed offline on November 4. Neither has a later status on the page this desk read.
Remediation, per the notice: third-party security experts and large language models were brought in to review the platform, proactive monitoring was added, IP allowlisting was introduced, and two-factor authentication is recommended for accounts that lack it.
What Chainalysis says was not touched, and what it has not said
The notice says there is no evidence that investigations data was accessed or attribution data manipulated. That is the claim customers most need to be true: Chainalysis attributions are used by law enforcement and firms across the industry. “No evidence” is not a finding that nothing happened, and the notice does not describe how that conclusion was reached or whether anyone outside the company has checked it.
Also unstated, in the notice or in The Hacker News’s report: how many users were affected, when the intruder first got in and when it was shut out, who the attacker is, and what “offensive agentic techniques” means in practice. The Hacker News reports that Chainalysis said the attack resembled those on “many other tech platforms in recent weeks,” without naming any.
Outlets also disagree on dates. Some secondary write-ups place the scope update on Wednesday, others on Friday; the notice’s own timestamps put the all-users entry at 11:00 P.M. EST on Wednesday, November 4, and this story follows them.
The Take
Revising a notice as an investigation widens is normal, and Chainalysis has been unusually timestamped about it. The harder question is the one the page cannot answer: a firm that sells attribution of other people’s breaches is asking customers to accept “no evidence” about its own. A fuller post-incident report, with an outside reviewer’s name on it, would be the useful next document.