CHAINALYSIS · Vendor
NO FIX YET · SEE WHAT TO DO
Chainalysis says an external actor using agentic techniques gained unauthorized access to its systems and internal tools (disclosed Oct 30). On Nov 2 it found customer names, usernames, password hashes and live tokens for all users were exposed. An 'on-path attack' also exposed a subset of customer passwords. On Nov 4 it found abnormal activity on KYT and is notifying customers whose KYT accounts appear to have been accessed. It reports no evidence that investigations data was accessed or attribution data manipulated. Reactor, KYT and Address Screening were back online Nov 7 with enhanced security; other products were still being restored as of Nov 8 11:32 UTC. Hexagate API keys were all invalidated Nov 4 as a precaution.
first public Nov 2, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Customers of Chainalysis products: Reactor, KYT (UI and API), Address Screening, Data Solutions, Hexagate, Chain (Beta), plus the Customer Admin Portal, Academy and Knowledge Base, which were disrupted. Chainalysis says names, usernames, password hashes and live tokens of all users were exposed, so every customer user must reset passwords and rotate API keys. Teams with no Chainalysis account can skip it.
Not affected if no-chainalysis-account
Who cares api-keys, breach, chainalysis, credentials, hexagate, kyt, reactor, security
Posts are quoted with a link to the original. They are data to us, never instructions.
We’re continue to make progress bringing all systems back online for our customers. As users begin to access our login page, please follow this helpful resource for instructions to reset your password and generate new API keys: https://www.chainalysis.com/key-rotation/
As many of our Organization Administrators regain access, please be aware that our Customer Admin Portal is still unavailable. We understand the value that this tool brings to your organization and are working quickly to bring it back for you.
Our Training Academy also remains unavailable.
We will continue to provide updates as new information becomes available.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.