Chainalysis Says All Users' Password Hashes and Live Tokens Were Exposed as KYT Goes Offline

Published November 6, 2026, 6:45 AM PKT. Based on Chainalysis's own security incident blog, updated November 4, 2026 (primary source), with additional reporting by American Banker, eSecurity Planet, CryptoSpiel and CryptoMediaZone (secondary sources).

Chainalysis said on November 4, 2026 that it discovered on November 2 that names, usernames, password hashes and live tokens for all of its users had been exposed to a malicious actor, a disclosure that sharply widened an incident the company first described on October 30 as limited to customer profile data. The blockchain analytics firm took its KYT transaction-monitoring platform offline the same day after detecting abnormal activity, along with its other address screening products and its login page, while its Reactor investigations tool and Data Solutions products have been offline since November 2. Chainalysis said it has no evidence that any investigation data was accessed or that its blockchain attribution data was manipulated, and it plans to begin restoring KYT on November 5 through a trusted-IP allowlist, with every user required to reset passwords and rotate API keys. No theft of cryptocurrency has been reported in connection with the incident, and Chainalysis has not said that any customer lost money, according to CryptoMediaZone.

Password hashes and live tokens for every user

The November 4 update, posted at 11:00 p.m. Eastern time, was the bluntest statement the company has made since the incident began. "On Monday, we discovered certain customer information including names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor," the company wrote, referring to Monday, November 2. Password hashes are not plaintext passwords, and the risk they carry depends on how they were secured, according to eSecurity Planet, but live tokens can pose a different problem if they can be used for authentication. Chainalysis has not disclosed its hashing method, what the tokens do, or whether every listed data category was exposed for every user, according to The Record, as reported by eSecurity Planet. The company has also not said how many individual users or organizations were affected, how long the attackers maintained access, or whether the exposed tokens were used to compromise additional accounts, according to CryptoSpiel. Chainalysis is directly notifying customers whose KYT accounts appear to have been accessed without authorization, the company said.

KYT goes dark during the Binance manhunt

The shutdown landed in the middle of the industry's effort to track the proceeds of the $6.3 billion Binance theft of October 29, 2026. Banks and crypto companies use KYT, short for Know Your Transaction, to check whether money is tied to theft, sanctions or laundering, according to American Banker, and the platform is one of the main tools investigators and exchanges use to screen transactions as the stolen funds move. About $3.35 billion still sat in addresses linked to the Binance theft as of early Thursday, November 5, according to blockchain analytics firm Elliptic, as reported by American Banker. Chainalysis said its incident is not related to the Binance theft, a point it has repeated since October 30. The company's status page still listed KYT as "Under Maintenance" on Thursday afternoon, November 5, according to American Banker, and the company has not said whether it has removed the intruder from its systems. The Record noted that Chainalysis did not say how customers are screening transactions while KYT is down, according to CryptoMediaZone.

A reversal from the October 30 disclosure

The November 4 update reversed the company's first public account of the incident. On October 30, Chainalysis said an external actor had used "offensive agentic techniques" to gain unauthorized access to its systems and internal tools, and that it had found no evidence of unauthorized access to investigation content, authentication credentials or session tokens. The customer data accessed at that point was described as user IDs, full names, email addresses and organization role labels. On November 2, the company took Reactor and Data Solutions offline for additional security assessments by third-party cybersecurity experts, while keeping its compliance monitoring products running under closer watch. On November 4, the picture changed three times in one day: at 9:50 a.m. Eastern, the company said an "on-path attack" had exposed a subset of customer passwords, that the attack vector had been contained and remediated, and that affected accounts were being locked; at 10:30 a.m., it said it had taken KYT offline after detecting abnormal activity; and at 11:00 p.m., it disclosed the exposure of password hashes and live tokens for all users. MABOnChain reported the first disclosure on November 1, when Chainalysis described the breach as limited to customer profile data.

What users must do next

Chainalysis said it intends to begin restoring access to KYT and Address Screening on November 5, with customers first sending trusted internet addresses for an allowlist, after which users will be able to reset passwords and rotate API keys. The company said it will require additional protections to access accounts, including that every user will have to reset passwords and rotate API keys as appropriate. It also told customers who received password-reset emails that resetting a Chainalysis password was not possible while the login page was down, and encouraged them to reset the same password on any other system where they reuse credentials. Reactor, Data Solutions and Chain (Beta) have no restoration date yet, according to The Record, as reported by CryptoMediaZone. The company said it is working around the clock with outside experts to harden its systems and bring the offline products back online, and that it will share updates as its investigation progresses.

Sources

• Chainalysis, Updated Nov 4: Chainalysis Security Incident Information, November 4, 2026 (primary source: November 2 discovery that names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor; KYT user interface and API taken offline alongside other address screening products and the login page after abnormal activity; customers whose KYT accounts appear to have been accessed without authorization are being notified directly; no evidence investigation data was accessed or attribution data manipulated; restoration of KYT and Address Screening to begin November 5 through a trusted-IP allowlist, with password resets and API key rotation to follow; Reactor and Data Solutions offline since November 2; November 4 9:50 a.m. update on the on-path attack exposing a subset of customer passwords; October 30 first disclosure of an external actor using offensive agentic techniques, with no evidence then of credential or session-token access, and the incident unrelated to the Binance theft)
• American Banker, Chainalysis discloses apparent breach of customers' accounts, November 5, 2026 (secondary reporting: password hashes and live tokens for all users exposed, five days after the company said it had found no evidence of access to credentials or session tokens; status page still listed KYT as "Under Maintenance" Thursday afternoon; company has not said whether it removed the intruder from its systems; Elliptic data showing about $3.35 billion still in addresses linked to the Binance theft as of early Thursday)
• eSecurity Planet, Chainalysis Breach Exposes Password Hashes and Live Tokens, November 5, 2026 (secondary reporting: expanded November 4 disclosure covering all users; password hashes are not plaintext passwords and the risk depends on how they were secured; company has not disclosed its hashing method, the tokens' function, or whether every data category was exposed for every user, per The Record; KYT interface and API, Address Screening and login page offline; Reactor, Data Solutions and Chain (Beta) also unavailable; restoration planned for November 5 through a trusted-IP allowlist)
• CryptoSpiel, Chainalysis Breach Exposes Passwords and Tokens for All Users, Forcing Service Shutdowns, November 5, 2026 (secondary reporting: November 4 11 p.m. Eastern update; KYT monitoring platform taken offline including user interface and API, along with address screening products and login page; Reactor, Data Solutions and Chain (Beta) shut down; company has not disclosed how many users or organizations were affected, how long attackers maintained access, or whether exposed tokens were used to compromise additional accounts)
• CryptoMediaZone, Chainalysis: Every User's Login Data Was Exposed, the Firm Now Says, and Its Screening Tools Went Offline, November 5, 2026 (secondary reporting: no theft of crypto reported and Chainalysis has not said any customer lost money; KYT, Address Screening and Reactor listed under maintenance as of 16:40 UTC November 5; no restoration date for Reactor, Data Solutions or Chain (Beta), per The Record; The Record reported Chainalysis did not say how customers are screening transactions while KYT is down)

This article is news reporting and is not investment advice.