Short answer: Chainalysis, a blockchain analytics company, experienced a cyber breach exposing user data. All users, including those in law enforcement, are affected. Reset passwords and API keys promptly.
TL;DR
- Chainalysis users' data exposed.
- All user categories impacted.
- Reset passwords and API keys.
- Follow direct links for login.
What happened at Chainalysis?
Chainalysis, a company that analyzes blockchain data, faced a cyber attack where user data, including names, usernames, and passwords, was exposed. This incident affected all users, including those from law enforcement and national security sectors. To secure accounts, users must reset their passwords and rotate API keys, and use direct login links.
- Data breach
- When private information is stolen or exposed to people who should not see it.
- Credentials / secrets
- Passwords, keys and tokens that prove who you are to a system.
Key facts
| Reported by | The Record |
|---|---|
| Date reported | 05 Nov 2026 |
How it works
Chainalysis, a blockchain analytics company, was hit by a cyberattack where attackers used 'agentic' techniques to access user data. This involved intercepting communications and exposing sensitive information like names, usernames, and password hashes.
- Exposed password hashes and tokens.
- Accessed KYT and Address Screening services.
- Noted abnormal activity.
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-11-05 | Reported by The Record | The Record |
| 2026-11-12 | This Skillmate explainer published | Skillmate |
How to fix it
- If you have an account with the affected company, change that password and any reused copies of it.
- Turn on two-factor authentication (a second login step) wherever the service offers it.
- Expect phishing emails or calls that use the exposed details; verify requests through official channels.
How to detect it
In a breach, defenders should check logs for unusual activity, like failed login attempts or unexpected transactions.
Signs to watch for:
- Login alerts from new devices or locations on the affected account.
- Password-reset emails you did not ask for.
- Phishing messages that quote your real account details.
What is confirmed
- Reported by The Record
- Reported by www.chainalysis.com
Why it matters
This attack matters because it exposed sensitive user data, potentially compromising accounts. Companies and users should be vigilant and secure their accounts by resetting passwords and rotating API keys.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What information was exposed in the breach?
Names, usernames, password hashes, and live tokens for all Chainalysis users were exposed to a malicious actor.
How many users were affected?
Chainalysis has over 1,500 customers, but the exact number of users affected is not specified.
What is an 'on-path attack'?
An on-path attack is when an attacker intercepts communications between a user and a service, potentially exposing passwords and tokens.
Sources
- Chainalysis warns all users hit in cyber breach involving ‘agentic’ techniques (The Record)
- Chainalysis (primary source) (www.chainalysis.com)
How we wrote this: facts come from the sources above. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.
Watch today's video brief: https://youtu.be/yaK-CF987xg