The breach at Chainalysis is bigger than first admitted. The blockchain-tracing firm now says every user’s sign-in details were taken: usernames, hashed passwords and tokens that still work. Everybody with an account, from crypto exchanges to government investigators, must choose a new password and replace their API keys before they can sign in again.
The company found the problem on Monday, 2 November, and said so in an update two days later. A separate “on-path” attack, where someone sits on kit that carries traffic between two endpoints, had also exposed some customers’ passwords. Chainalysis says it has found and shut that route, but it has not said where the interception happened or whether the traffic was encrypted at the time.
The first notice read very differently. When the company confirmed the intrusion on 30 October, it described a narrower loss, mostly identity details such as names and work emails, and said credentials and session tokens looked untouched. Its explanation was that an outside party had used AI agents to break into internal tools.
Once the wider exposure came out, the company pulled the login page offline, along with Reactor, Data Solutions, the Know Your Transaction (KYT) interface and API, and address screening. Access returns by request: a customer sends the IP addresses it trusts to support or its account manager, and those are whitelisted. Resets and key rotation come next, and Chainalysis says KYT and address screening began returning in stages on Friday.
The company maintains that nothing shows investigation data was opened or its attribution data, the labels tying wallet addresses to real entities, was altered. Even so, stolen log-ins for analysts at banks and agencies could be used for impersonation, so users are told to be wary of password-reset prompts they did not request and of anyone claiming to be from Chainalysis.
The original notice advised customers to turn on two-factor authentication, which matters more now that password hashes are in an attacker’s hands. Chainalysis has not said whether the intruders used an existing offensive framework or agents built for the job; security researchers have noted that a tool called ARTEX has appeared in other recent intrusions, but the company has not linked it to this one. Outside security specialists are helping with the investigation, and the firm says it is also running AI models over its own platform as part of the review.
Several questions are still open. Chainalysis took two days to tell customers after finding the exposure, has shared nothing about how the AI agents operated, and earlier labelled names and email addresses “non-sensitive”. A spokesperson said the firm would add nothing to its blog post.
It lands in a month of crypto-industry security failures. Chainalysis says this incident has no link to the $6.3 billion Binance theft that the FBI pinned on North Korea.
