Vendor incident, severity critical
Chainalysis breach exposed usernames, password hashes and live tokens for all customers
Published
Chainalysis says an attack on its systems and internal tools exposed names, usernames, password hashes and live tokens for all customers, in what it described as an on-path (MITM) attack. This goes beyond its earlier disclosure of names and emails. The company took the login portal, Reactor, Data Solutions, the KYT interface and API, and address screening offline after finding further abnormal activity. It reports no evidence that investigations data was accessed or attribution data manipulated.
What's affected
- chainalysisevery version
What to do
- Contact Chainalysis support or your account team with trusted IP addresses for the allowlist to regain access
- Reset all user passwords once access is granted
- Rotate Chainalysis API keys, including those used to register transactions
- Expect additional access protections when the services come back online
Secrets to rotate if you were affected
Platform tokens.
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident chainalysis-credential-exposure-2026-11References
Notice chainalysis-credential-exposure-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.