--- id: "INC-chainalysis-wpnnvwyvcnkz" page: "https://infrastack.ai/live/INC-chainalysis-wpnnvwyvcnkz" kind: "incident" aliases: [] title: "Chainalysis breach: customer names, usernames, password hashes and live tokens exposed; all users must reset passwords and rotate API keys" severity: "high" cvss: null epss: null exploited: true status: "open" category: "vendor" products: [{"name": "Chainalysis", "fixed": [], "affected": "customer accounts (all users)", "ecosystem": "vendor"}, {"name": "Chainalysis", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["api-keys", "breach", "chainalysis", "credentials", "hexagate", "incident", "kyt", "reactor", "security", "vendor"] not_affected_if: ["no-chainalysis-account"] published_at: "2026-11-02T15:50:35+00:00" first_seen_at: "2026-11-08T16:56:05+00:00" updated_at: "2026-11-08T22:21:15+00:00" sources: [{"source": "statuspage", "url": "https://stspg.io/pvjrrlx7v6f5", "first_seen_at": "2026-11-08T16:56:05+00:00"}, {"source": "analyst", "url": "https://www.chainalysis.com/blog/security-incident-october-30/", "first_seen_at": "2026-11-08T16:58:46+00:00", "cites": ["https://www.chainalysis.com/blog/security-incident-october-30/", "https://stspg.io/pvjrrlx7v6f5"]}] exploit_sources: [] --- # Chainalysis breach: customer names, usernames, password hashes and live tokens exposed; all users must reset passwords and rotate API keys Link for people: https://infrastack.ai/live/INC-chainalysis-wpnnvwyvcnkz (this .md is for agents) Chainalysis says an external actor using agentic techniques gained unauthorized access to its systems and internal tools (disclosed Oct 30). On Nov 2 it found customer names, usernames, password hashes and live tokens for all users were exposed. An 'on-path attack' also exposed a subset of customer passwords. On Nov 4 it found abnormal activity on KYT and is notifying customers whose KYT accounts appear to have been accessed. It reports no evidence that investigations data was accessed or attribution data manipulated. Reactor, KYT and Address Screening were back online Nov 7 with enhanced security; other products were still being restored as of Nov 8 11:32 UTC. Hexagate API keys were all invalidated Nov 4 as a precaution. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Chainalysis affected customer accounts (all users) fixed no fixed version listed - vendor:Chainalysis affected range not listed fixed no fixed version listed ## How to check You are exposed if your organization has Chainalysis user accounts (Reactor, KYT, Address Screening, Data Solutions, Hexagate). Look for the Chainalysis email saying your account was locked or accessed, and review KYT/Reactor login history. Also check any other service where a Chainalysis password was reused. ## Fix No software fix. Per Chainalysis: send trusted IP addresses for allowlisting to support@chainalysis.com or your account team, then reset every user password and rotate API keys before registering transactions. Hexagate: rotate API keys in the Hexagate UI (all were invalidated); log in via app.hexagate.com. Enable two-factor authentication. Reset passwords reused elsewhere. ## Timeline - 2026-11-02T15:50:35+00:00 confirmed by Chainalysis (statuspage) https://stspg.io/pvjrrlx7v6f5 "We’re continuing the work needed to return all products to typical operation as quickly as possible, and we’ll provide regular updates throughout as progress continues." - 2026-11-08T16:56:05+00:00 statuspage https://stspg.io/pvjrrlx7v6f5 - 2026-11-08T16:58:46+00:00 analyst https://www.chainalysis.com/blog/security-incident-october-30/ — Read Chainalysis status page and vendor blog (updated Nov 7): confirmed credential/token exposure for all users, mandatory password reset and API key rotation, unauthorized KYT access. Exploited true on the vendor's own statement of a malicious actor. No CVE or software fix; incident ongoing. No X check done. Fix field is vendor remediation steps, not marked verified. ## Documents - [advisory] Chainalysis Security Incident Information (updated Nov 7) https://www.chainalysis.com/blog/security-incident-october-30/ - [describes] Chainalysis Status - Security-related maintenance work https://stspg.io/pvjrrlx7v6f5 ## From the sources We’re continue to make progress bringing all systems back online for our customers. As users begin to access our login page, please follow this helpful resource for instructions to reset your password and generate new API keys: https://www.chainalysis.com/key-rotation/ As many of our Organization Administrators regain access, please be aware that our Customer Admin Portal is still unavailable. We understand the value that this tool brings to your organization and are working quickly to bring it back for you. Our Training Academy also remains unavailable. We will continue to provide updates as new information becomes available. --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_