{"id":"INC-chainalysis-wpnnvwyvcnkz","kind":"incident","aliases":[],"related":[],"title":"Chainalysis breach: customer names, usernames, password hashes and live tokens exposed; all users must reset passwords and rotate API keys","description":"We’re continue to make progress bringing all systems back online for our customers.  As users begin to access our login page, please follow this helpful resource for instructions to reset your password and generate new API keys: https://www.chainalysis.com/key-rotation/\n\nAs many of our Organization Administrators regain access, please be aware that our Customer Admin Portal is still unavailable.  We understand the value that this tool brings to your organization and are working quickly to bring it back for you.\n\nOur Training Academy also remains unavailable.\n\nWe will continue to provide updates as new information becomes available.","summary":"Chainalysis says an external actor using agentic techniques gained unauthorized access to its systems and internal tools (disclosed Oct 30). On Nov 2 it found customer names, usernames, password hashes and live tokens for all users were exposed. An 'on-path attack' also exposed a subset of customer passwords. On Nov 4 it found abnormal activity on KYT and is notifying customers whose KYT accounts appear to have been accessed. It reports no evidence that investigations data was accessed or attribution data manipulated. Reactor, KYT and Address Screening were back online Nov 7 with enhanced security; other products were still being restored as of Nov 8 11:32 UTC. Hexagate API keys were all invalidated Nov 4 as a precaution.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":null,"products":[{"name":"Chainalysis","fixed":[],"affected":"customer accounts (all users)","ecosystem":"vendor"},{"name":"Chainalysis","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["api-keys","breach","chainalysis","credentials","hexagate","incident","kyt","reactor","security","vendor"],"not_affected_if":["no-chainalysis-account"],"how_to_check":"You are exposed if your organization has Chainalysis user accounts (Reactor, KYT, Address Screening, Data Solutions, Hexagate). Look for the Chainalysis email saying your account was locked or accessed, and review KYT/Reactor login history. Also check any other service where a Chainalysis password was reused.","fix":"No software fix. Per Chainalysis: send trusted IP addresses for allowlisting to support@chainalysis.com or your account team, then reset every user password and rotate API keys before registering transactions. Hexagate: rotate API keys in the Hexagate UI (all were invalidated); log in via app.hexagate.com. Enable two-factor authentication. Reset passwords reused elsewhere.","status":"open","published_at":"2026-11-02T15:50:35+00:00","first_seen_at":"2026-11-08T16:56:05+00:00","triaged_at":"2026-11-08T16:57:01+00:00","updated_at":"2026-11-08T22:21:15+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-08T16:57:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Chainalysis: security maintenance keeps products offline, no details given","impact":"low","summary":"Chainalysis reports an open incident for security-related maintenance work and says it is working to return all products to normal operation. The notice does not say what was affected or what an attacker could reach.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["chainalysis"],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the Chainalysis statuspage (https://stspg.io/pvjrrlx7v6f5) and any later updates for the affected products, data exposure and whether customers must rotate credentials or API keys.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000628,"input_tokens":4511,"output_tokens":354,"severity_before":"high","breached_checked":true},"analyst_status":"done","analyst_note":"Check the Chainalysis statuspage (https://stspg.io/pvjrrlx7v6f5) and any later updates for the affected products, data exposure and whether customers must rotate credentials or API keys.","search":"'/key-rotation/':200C '11':146B '2':61B '30':58B '32':147B '4':91B,156B '7':132B '8':145B 'abnorm':94B 'academi':243C 'access':49B,109B,118B,178C,208C 'account':104B 'activ':95B 'actor':43B 'address':126B 'admin':215C 'administr':206C 'agent':45B 'also':82B,244C 'api':19A,28B,150B,196C 'api-key':27B 'appear':105B 'attack':81B 'attribut':120B 'avail':257C 'awar':211C 'back':129B,169C,238C 'becom':256C 'begin':176C 'breach':2A,30B 'bring':166C,227C,236C 'chainalysi':1A,31B,39B 'chainalysis':23A,25A,26A 'continu':162C,249C 'credenti':32B 'custom':3A,64B,87B,101B,173C,214C 'data':116B,121B 'disclos':56B 'enhanc':134B 'evid':113B 'expos':11A,76B,83B 'extern':42B 'follow':183C 'found':63B,93B 'gain':47B 'generat':194C 'hash':7A,68B 'help':185C 'hexag':33B,149B 'inc':22A 'inc-chainalysis-wpnnvwyvcnkz':21A 'incid':34B 'inform':255C 'instruct':188C 'intern':54B 'invalid':154B 'investig':115B 'key':20A,29B,151B,197C 'kyt':35B,97B,103B,124B 'live':9A,70B 'login':180C 'make':164C 'mani':202C 'manipul':122B 'must':14A 'name':4A,65B 'new':195C,254C 'notifi':100B 'nov':60B,90B,131B,144B,155B 'oct':57B 'on-path':78B 'onlin':130B,170C 'organ':205C,230C 'page':181C 'password':6A,16A,67B,88B,192C 'path':80B 'pleas':182C,209C 'portal':216C 'precaut':159B 'product':137B 'progress':165C 'provid':251C 'quick':234C 're':161C 'reactor':36B,123B 'regain':207C 'remain':245C 'report':111B 'reset':15A,190C 'resourc':186C 'restor':141B 'rotat':18A 'say':40B 'screen':127B 'secur':37B,135B 'still':139B,218C 'subset':85B 'system':52B,168C 'techniqu':46B 'token':10A,71B 'tool':55B,226C 'train':242C 'unauthor':48B 'unavail':219C,246C 'understand':221C 'updat':252C 'use':44B 'user':13A,74B,175C 'usernam':5A,66B 'utc':148B 'valu':223C 'vendor':38B 'whose':102B 'work':233C 'wpnnvwyvcnkz':24A 'www.chainalysis.com':199C 'www.chainalysis.com/key-rotation/':198C","nicknames":[],"mitigations":[],"who_affected":"Customers of Chainalysis products: Reactor, KYT (UI and API), Address Screening, Data Solutions, Hexagate, Chain (Beta), plus the Customer Admin Portal, Academy and Knowledge Base, which were disrupted. Chainalysis says names, usernames, password hashes and live tokens of all users were exposed, so every customer user must reset passwords and rotate API keys. Teams with no Chainalysis account can skip it.","tier":"C","verified":{"how_to_check":{"at":"2026-11-08T16:58:46Z","by":"analyst","doc":"https://www.chainalysis.com/blog/security-incident-october-30/","run_id":2193},"who_affected":{"at":"2026-11-08T16:58:46Z","by":"analyst","doc":"https://www.chainalysis.com/blog/security-incident-october-30/","run_id":2193}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["chainalysis"],"ptokens":["chainalysis"],"labels":["apikeys","breach","chainalysis","credentials","hexagate","high","incident","kyt","reactor","security","vendor"],"campaign_type":null,"search_a":"'api':19A 'breach':2A 'chainalysi':1A 'chainalysis':23A,25A,26A 'custom':3A 'expos':11A 'hash':7A 'inc':22A 'inc-chainalysis-wpnnvwyvcnkz':21A 'key':20A 'live':9A 'must':14A 'name':4A 'password':6A,16A 'reset':15A 'rotat':18A 'token':10A 'user':13A 'usernam':5A 'wpnnvwyvcnkz':24A","search_b":"'11':146B '2':61B '30':58B '32':147B '4':91B,156B '7':132B '8':145B 'abnorm':94B 'access':49B,109B,118B 'account':104B 'activ':95B 'actor':43B 'address':126B 'agent':45B 'also':82B 'api':28B,150B 'api-key':27B 'appear':105B 'attack':81B 'attribut':120B 'back':129B 'breach':30B 'chainalysi':31B,39B 'credenti':32B 'custom':64B,87B,101B 'data':116B,121B 'disclos':56B 'enhanc':134B 'evid':113B 'expos':76B,83B 'extern':42B 'found':63B,93B 'gain':47B 'hash':68B 'hexag':33B,149B 'incid':34B 'intern':54B 'invalid':154B 'investig':115B 'key':29B,151B 'kyt':35B,97B,103B,124B 'live':70B 'manipul':122B 'name':65B 'notifi':100B 'nov':60B,90B,131B,144B,155B 'oct':57B 'on-path':78B 'onlin':130B 'password':67B,88B 'path':80B 'precaut':159B 'product':137B 'reactor':36B,123B 'report':111B 'restor':141B 'say':40B 'screen':127B 'secur':37B,135B 'still':139B 'subset':85B 'system':52B 'techniqu':46B 'token':71B 'tool':55B 'unauthor':48B 'use':44B 'user':74B 'usernam':66B 'utc':148B 'vendor':38B 'whose':102B","search_c":"'/key-rotation/':200C 'academi':243C 'access':178C,208C 'admin':215C 'administr':206C 'also':244C 'api':196C 'avail':257C 'awar':211C 'back':169C,238C 'becom':256C 'begin':176C 'bring':166C,227C,236C 'continu':162C,249C 'custom':173C,214C 'follow':183C 'generat':194C 'help':185C 'inform':255C 'instruct':188C 'key':197C 'login':180C 'make':164C 'mani':202C 'new':195C,254C 'onlin':170C 'organ':205C,230C 'page':181C 'password':192C 'pleas':182C,209C 'portal':216C 'progress':165C 'provid':251C 'quick':234C 're':161C 'regain':207C 'remain':245C 'reset':190C 'resourc':186C 'still':218C 'system':168C 'tool':226C 'train':242C 'unavail':219C,246C 'understand':221C 'updat':252C 'user':175C 'valu':223C 'work':233C 'www.chainalysis.com':199C 'www.chainalysis.com/key-rotation/':198C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-02T15:50:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"chainalysis:wpnnvwyvcnkz","url":"https://stspg.io/pvjrrlx7v6f5","severity":"high","published_at":"2026-11-02T15:50:35+00:00","modified_at":"2026-11-08T22:20:01+00:00","first_seen_at":"2026-11-08T16:56:05+00:00","fetched_at":"2026-11-09T02:19:09+00:00","note":null},{"source":"analyst","external_id":"INC-chainalysis-wpnnvwyvcnkz:2193","url":"https://stspg.io/pvjrrlx7v6f5","severity":null,"published_at":"2026-11-08T16:58:46+00:00","modified_at":"2026-11-08T16:58:46+00:00","first_seen_at":"2026-11-08T16:58:46+00:00","fetched_at":"2026-11-08T16:58:46+00:00","note":"Read Chainalysis status page and vendor blog (updated Nov 7): confirmed credential/token exposure for all users, mandatory password reset and API key rotation, unauthorized KYT access. Exploited true on the vendor's own statement of a malicious actor. No CVE or software fix; incident ongoing. No X check done. Fix field is vendor remediation steps, not marked verified.","cites":["https://stspg.io/pvjrrlx7v6f5","https://www.chainalysis.com/blog/security-incident-october-30/"]}],"documents":[{"id":102601,"url":"https://stspg.io/pvjrrlx7v6f5","title":"Chainalysis Status - Security-related maintenance work","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":102602,"url":"https://www.chainalysis.com/blog/security-incident-october-30/","title":"Chainalysis Security Incident Information (updated Nov 7)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[{"company":"Chainalysis","domain":"stspg.io","url":"https://stspg.io/pvjrrlx7v6f5","kind":"statuspage","published_at":"2026-11-02T15:50:35+00:00","quote":"We’re continuing the work needed to return all products to typical operation as quickly as possible, and we’ll provide regular updates throughout as progress continues.","confidence":0.8999999761581421,"source":"statuspage","created_at":"2026-11-08T17:12:38+00:00","entry":"unknown"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}