Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services

Summary: Chainalysis disclosed that its investigation into an ongoing agentic cyber attack found names, usernames, password hashes and live tokens exposed for all users, and it took Reactor, Data Solutions, the Know Your Transaction user interface and API, other address screening products and the login page offline. The company locked impacted accounts, said it had no evidence investigations data was accessed or attribution data manipulated, and on November 7, 2026 reported Reactor, KYT and Address Screening restored with enhanced security measures requiring every user to reset passwords and rotate API keys.
Bottom line: Every Chainalysis user's credentials - password hashes and live tokens included - were exposed, and the company's own password reset could not be completed while its login page was offline. Microsoft tied the wider campaign to agents that moved from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in five minutes, with activity assessed as ongoing from August 2026.

Read the original at The Hacker News ↗