Chainalysis says attackers stole password hashes and tokens for every customer

Every Chainalysis user has to reset a password this week. Chainalysis says attackers stole names, usernames, password hashes and live tokens for every Chainalysis user. The company first disclosed the incident on 30 October. It updated the note this week with more detail. Ars Technica covered the update on the same day.

The story matters to any team with a Chainalysis account. It also matters to any team whose staff reuses passwords across tools.

What Chainalysis says happened

Chainalysis says the attack was "a multifront cyberattack". The company says attackers used "offensive agentic techniques" to break in. The note does not name the tools or models. A subset of passwords was taken through an on-path attack. Live tokens for all Chainalysis users were taken. Attackers also made unauthorized access attempts on some customer accounts.

Chainalysis says it found "no evidence of unauthorized access" to investigation content or session tokens. The company says it saw abnormal activity in its compliance monitoring products.

What customers have to do now

Chainalysis lists the steps on the disclosure page. Reset the Chainalysis password through the official login page. Rotate every API key. Turn on two-factor authentication. Submit trusted IP addresses to the allowlist. Reset the same password on any other service where it was reused. Watch for messages that pretend to come from Chainalysis.

The last step is the one that matters outside Chainalysis. A password that works on Chainalysis today may work on another tool tomorrow. A team that let staff reuse passwords has to sweep every tool where that password sits.

The agent part of the story

The note calls the attack method "offensive agentic techniques". Chainalysis also says it used "sophisticated large language models" to help its own security review. The company gives no names, no model versions and no detail of how the attack was run. A security team cannot build a defence from the words on the page alone.

Two facts are clear from the note itself. An attack this large used an AI agent as part of the tool chain. The response is still manual: a human in each company has to reset passwords and rotate keys. Both halves will show up on more incident pages this year.

A buyer of AI tools should treat agent-driven attacks as a current risk, not a future one. The checklist on this page is one a team can apply today, on every tool that holds live customer tokens.

Source

• Updated Nov 6: Chainalysis Security Incident Information, Chainalysis.
• Chainalysis says hackers stole credentials and tokens for all of its customers, Ars Technica.