Chainalysis said all of its users were affected by a cyberattack in which an “on-path attack” exposed a subset of customer passwords, including those of the recipients it notified, according to a November 4 update. The disclosure reversed the blockchain analytics firm’s initial assessment of an incident it said began with an attack on October 30, 2026, when it reported finding no evidence that credentials or session tokens had been exposed. An on-path attack involves an attacker intercepting communications between a user and a service, a technique long described as a man-in-the-middle attack.

The company said the attack had been contained and remediated, and it required affected users to reset their passwords. It also advised customers to rotate API keys as appropriate. The breach disrupted access to products used by governments, law enforcement agencies and businesses to track cryptocurrency transactions.

How the Password Exposure Expanded

In its October 30 notification, Chainalysis described the attack as “similar to many other tech platforms in recent weeks” and said the incident was unrelated to the recent crypto theft involving Binance. At that stage, the company said attackers had accessed only non-sensitive user information, including user IDs, full names, email addresses and organization role labels.

Chainalysis later said the attackers had used “offensive agentic techniques,” a term generally used to describe attack methods that employ autonomous AI agents. Its initial investigation found no evidence that investigation content such as graphs, notes or cases had been accessed. The company also said it had found no evidence of compromised transaction or query results, passwords in clear text, multi-factor authentication secrets or user session tokens.

That assessment changed on November 4. “Today, we confirmed that as a part of this incident, an ‘on-path attack’ exposed a subset of customer passwords, including yours,” the company said in an email to affected parties. Chainalysis said it had contained and remediated the attack vector, but did not say in the account provided how many passwords were exposed.

Services Face a Cautious Restoration

Chainalysis locked users out and directed them to reset their credentials through its standard login page. It also took Reactor, Data Solutions and Chain (Beta) offline “out of an abundance of caution.” Separately, the company cited abnormal activity when it took down the KYT (Know Your Transaction) user interface and API, other address screening products and the login page.

The company said it had begun partially restoring KYT and Address Screening, telling customers to expect access to return “over the next several hours” while it proceeded carefully and monitored each phase. Customers seeking access sooner were invited to submit a trusted IP address by email and prepare to reset their credentials.

Chainalysis said it was working “around the clock” to harden its systems and restore Reactor and Data Solutions. The company acknowledged the disruption and thanked customers for their patience. The account did not provide a completion date for restoring those services.

Why the Incident Matters for Crypto Investigations

Chainalysis describes its work as blockchain analytics used by governments, law enforcement agencies and businesses to track and investigate cryptocurrency transactions. Police have used its tools to trace stolen funds, identify illicit activity and investigate cryptocurrency-related crimes.

The company has said the incident is separate from the recent crypto theft involving Binance, funds from which analysts have been tracing separately. As of the latest update, no threat actors had claimed responsibility and the exposed data had not appeared on the dark web. The account did not report an extortion demand or say attackers had contacted Chainalysis. The company’s stated next steps are continued system hardening, careful service restoration and additional account protections, including password resets and API key rotation where appropriate.