- Chainalysis said hackers obtained names, usernames, password hashes, and live tokens for all of its customers, disclosing the full scope on Wednesday, November 4, 2026.
- The blockchain analytics firm’s customer list includes the FBI, US Immigration and Customs Enforcement, the US Air Force, Microsoft, Coinbase, and Barclays.
- Chainalysis said the breach involved AI agent-assisted offensive techniques and an on-path attack that intercepted a subset of customer passwords.
- The company took down its login page and Know Your Transaction service and is requiring mandatory credential rotation once access is restored.
What Happened
Chainalysis disclosed Wednesday that an investigation two days earlier found that names, usernames, password hashes, and live tokens for all Chainalysis users had been exposed to a malicious actor. The company had first flagged the incident the previous Friday as limited to “non-sensitive” data such as user IDs, full names, email addresses, and organization role labels.
Why It Matters
As a blockchain analytics provider used by government agencies and major financial institutions to trace cryptocurrency transactions, Chainalysis holds credentials and access that could expose far more than its own systems. The breach is one of several disclosed in October and November 2026 that involved AI-assisted attack techniques, a pattern security researchers have flagged as accelerating.
Technical Details
Chainalysis said part of the “ongoing multifront cyberattack” involved an on-path attack, also known as an adversary-in-the-middle attack, where a hacker intercepts traffic passing between two parties. The company has not disclosed where the compromised infrastructure sits or whether the intercepted traffic was encrypted, and it has not detailed how the AI agents it blamed for initial access actually operated.
Who’s Affected
Chainalysis and public reporting have named the FBI, US Immigration and Customs Enforcement, the US Air Force, Microsoft, Coinbase, and Barclays among its customers. In response to the breach, the company disabled its login page and Know Your Transaction service and removed access to its Reactor and Data Solutions products.
What’s Next
Chainalysis began phasing customer access back into Know Your Transaction and Address Screening on Friday and is asking customers to submit trusted IP addresses for an allow list. Credential rotation will be mandatory once full access is restored. The company says its investigation has so far found no evidence that its investigation data was accessed or that its attribution data was manipulated.
Ars Technica, November 6, 2026.
