---
title: Chainalysis now says names, usernames, password hashes and live tokens for all its users were exposed; KYT and the login page taken offline after new 'abnormal activity' | ctxsec
url: https://ctxsec.com/items/chainalysis-update-all-users-password-hashes-live-tokens-kyt-offline
description: "Chainalysis's Nov 4 update expands its Oct 30 disclosure, which had said no credentials or session tokens were accessed. It says it discovered on Monday (Nov 2) that names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor, and it pulled Reactor and Data Solutions offline. Earlier on Nov 4 it told some customers an 'on-path attack' had exposed their passwords (contained, accounts locked). Later that day it saw abnormal activity and took KYT (UI and API), other address-screening products and the login page offline, and is notifying customers whose KYT accounts appear to have been accessed without authorization. It still says it has no evidence investigations data was accessed or attribution data manipulated. It originally described the intruder as using 'offensive agentic techniques' but hasn't explained that."
status: "official (Chainalysis incident update, Nov 4, 11:00 PM EST)"
published: 2026-11-04
---

> Chainalysis's Nov 4 update expands its Oct 30 disclosure, which had said no credentials or session tokens were accessed. It says it discovered on Monday (Nov 2) that names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor, and it pulled Reactor and Data Solutions offline. Earlier on Nov 4 it told some customers an 'on-path attack' had exposed their passwords (contained, accounts locked). Later that day it saw abnormal activity and took KYT (UI and API), other address-screening products and the login page offline, and is notifying customers whose KYT accounts appear to have been accessed without authorization. It still says it has no evidence investigations data was accessed or attribution data manipulated. It originally described the intruder as using 'offensive agentic techniques' but hasn't explained that.

[← Cybersecurity News](/news) · [markdown](/items/chainalysis-update-all-users-password-hashes-live-tokens-kyt-offline.md)

official (Chainalysis incident update, Nov 4, 11:00 PM EST)

2026-11-04

### Chainalysis now says names, usernames, password hashes and live tokens for all its users were exposed; KYT and the login page taken offline after new 'abnormal activity'

- **Customers:** every user will have to reset passwords and rotate API keys. KYT and Address Screening access is being restored only for trusted IP addresses you send to Chainalysis support for its allowlist.
- Go to the Chainalysis login page directly; don't follow links in reset emails, which make convenient phishing lures right now.
- Reset the same password anywhere else you reused it, and rotate any Chainalysis API keys stored in pipelines or screening integrations once you can.
- Review your own logs for KYT API calls or account activity you don't recognize since late October.

See our [Oct 30 item](/items/chainalysis-security-incident-agentic-intrusion-customer-user-data) for the original disclosure.

Sources: [Chainalysis: Security Incident Information (updated Nov 4, 11:00 PM EST)](https://www.chainalysis.com/blog/security-incident-october-30/) · [The Record: Chainalysis warns all users hit in cyber breach involving 'agentic' techniques (Nov 5)](https://therecord.media/chainalysis-all-users-hit-by-agentic-cyberattack)