Hackers stole credentials for all Chainalysis users
Original: Chainalysis says hackers stole credentials and tokens for all of its customers
Why This Matters
Chainalysis underpins global crypto crime investigations; a full credential breach is severe.
Blockchain analytics firm Chainalysis confirmed hackers accessed names, usernames, password hashes, and live tokens for all users via a 'multifront cyberattack' in October 2026, affecting clients including the FBI, ICE, Microsoft, and Coinbase.
Chainalysis disclosed that a cyberattack in October 2026 exposed sensitive data for its entire user base. The breach involved AI agent-assisted offensive techniques and an on-path (adversary-in-the-middle) attack that intercepted traffic between parties, capturing password hashes and live session tokens. The company initially described some exposed data—user IDs, full names, email addresses, organization roles—as 'non-sensitive,' a characterization that raised immediate questions.
The client list at risk reads like a who's who of crypto enforcement and finance: the FBI, ICE, the US Air Force, Microsoft, Coinbase, and Barclays are among confirmed customers. Chainalysis took down its login page and its know-your-transaction (KYT) service after detecting abnormal activity. Access to Reactor and Data Solutions was also suspended.
By Friday, the company had begun restoring KYT and Address Screening access, requiring customers to submit trusted IP addresses for allowlisting. Credential resets are mandatory. Chainalysis says no investigation data was accessed and no attribution data was manipulated—but the source of the on-path compromise remains unidentified, and whether intercepted traffic was TLS-encrypted has not been disclosed.