Chainalysis, the company that police and exchanges use to trace stolen crypto, widened its breach notice on November 4. It now says names, usernames, password hashes and live login tokens for all of its users were exposed. A week earlier it said no passwords or tokens were reached. Several of its tools went offline. It says there's no sign investigation data was touched.

Key facts

  • Who: Chainalysis, a blockchain tracing firm used by police, governments and exchanges
  • What: An October intrusion; the November 4 update says password hashes and live tokens for all users were exposed
  • Offline: Reactor and Data Solutions since November 2; KYT, Address Screening and the login page after abnormal activity
  • When: First notice October 30; updated November 4; restoring tools with resets and an IP allowlist from November 5
  • Source: eSecurity Planet and Bitcoin.com News

The company that tracks crypto thieves has a breach of its own, and it is bigger than it first said. Chainalysis updated its security notice on November 4. It now says names, usernames, password hashes and live login tokens for all of its users were exposed to an attacker, eSecurity Planet reported. It found this on Monday, November 2.

That reverses its first notice on October 30. Back then it said names, emails, user IDs and job roles were reached, with no sign of passwords or session tokens, BleepingComputer reported. It said the intruder used "offensive agentic techniques," meaning automated AI-driven tools, but gave no technical details.

What is offline

  • Reactor and Data Solutions, the tools investigators use to follow stolen funds, were taken offline on November 2.
  • KYT and Address Screening, which exchanges use to check deposits, went offline with the login page after abnormal activity, Bitcoin.com News reported.
  • The way back: access returns in phases from November 5. Users must reset passwords and change their API keys, which are the logins that customer software uses, and only approved customer addresses can connect.

Chainalysis says it has no evidence that investigation data was accessed or that its tracing data was changed. It hasn't said how the passwords were protected, what kind of tokens were taken, or how many people were affected, CoinCentral noted.

Why it matters if you never used Chainalysis

Its tools sit behind many of the hacks we cover, including the work to trace the Binance theft. A pause slows that tracing. Its name also carries weight, which makes it useful to scammers.

  • Expect fake "Chainalysis investigator" offers. Scammers often pose as tracing firms and promise to recover lost crypto for a fee. Here is how recovery scams work.
  • Know what tracing can and can't do. Read can crypto scams be traced before paying anyone.
  • Treat surprise password-reset emails as suspect. Go to the site yourself instead of clicking the link.

Sources: eSecurity Planet, Chainalysis breach exposes password hashes and live tokens (November 2026), Bitcoin.com News, Chainalysis breach exposes passwords and tokens for all users, forcing service shutdowns (November 2026), CoinCentral, Chainalysis breach disclosure widens in one week from names to live tokens (November 2026), BleepingComputer, Chainalysis discloses data breach from offensive agentic techniques (October 30, 2026).