Chainalysis: All Users' Credentials Exposed in Multi-Front Agentic AI Attack

Blockchain analysis firm Chainalysis disclosed on Nov 6, 2026 that an "ongoing multi-front cyber attack" carried out with "offensive agentic techniques" exposed the names, usernames, password hashes and live tokens of all of its users, according to a report by The Hacker News and the company's own incident blog. The disclosure is the latest development in an incident Chainalysis first acknowledged on Oct 30, 2026, and it has forced the firm to take several of its core products, including the KYT transaction-monitoring platform, offline while it hardens its systems. The company says it has "no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated," a position it stated in its Nov 4 update on its security blog.

What was the specific vulnerability?

The specific failure was unauthorized access to Chainalysis systems and internal tools by an external actor using AI agents, which resulted in the exposure of credentials and live tokens for every Chainalysis user. According to The Hacker News, the exposed data set covered names, usernames, password hashes and live tokens for all users of the platform. In a separate on-path attack, a subset of customer passwords was exposed; Chainalysis says that exposure has been contained and remediated. Some KYT accounts were accessed without authorization, and the company is directly notifying the affected customers. The firm has not disclosed the total number of users affected, saying only that the exposure covered all of them.

The attack used autonomous AI agents rather than conventional scripted tooling. Chainalysis described the intrusion as using "offensive agentic techniques" and noted that it resembled activity seen at "many other tech platforms in recent weeks." According to The Hacker News, Microsoft reported in November 2026 that threat actors are using an agentic AI offensive framework called ARTEX to scan public GitHub repositories for exposed secrets, including credentials, application credentials and AI inference API keys, and to run follow-on attacks. In one case Microsoft documented, an AI agent moved from GitHub secret-scanning to exfiltrating Azure Key Vault data in five minutes, and Microsoft assessed the activity as ongoing since August 2026.

How was the incident detected?

The incident was detected by Chainalysis and the external security experts it engaged, first through the original Oct 30 intrusion and then through follow-on monitoring during the response. The company first disclosed the incident on Oct 30, 2026, reporting that an external actor had used agentic AI techniques to gain unauthorized access to its systems and internal tools. The broader exposure affecting all users was discovered on Monday, Nov 2, 2026, and disclosed publicly on Nov 4. On the same day, the firm detected abnormal activity in its KYT platform and responded by taking KYT, in both its user interface and API form, along with other address-screening products and the login page, offline. Sign-ins connected to the incident were traced to the IP addresses 199.19.77[.]84 and 199.19.77[.]18, according to The Hacker News.

What is the current impact?

The current impact is that every Chainalysis user must reset their password and rotate API keys, several products remain offline, and some KYT customers have been directly notified of unauthorized account access. As of the Nov 6 update, Chainalysis had begun a phased restoration of KYT and Address Screening. Reactor and Data Solutions, which the company proactively took offline on Nov 2, remain offline, as does the Chain (Beta) product. The company stated on Nov 4: "We are working around the clock to harden our systems and bring Reactor and Data Solutions back online... every user will have to reset passwords and rotate API keys as appropriate."

The firm maintains that its core analytical data was not touched. "At this time we continue to have no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated," Chainalysis said in its Nov 4 update, as reported by The Hacker News and published on the company's blog. For a firm whose business is tracing illicit cryptocurrency flows for governments and exchanges, the integrity of attribution data is the central reputational question, which makes that statement the most closely watched claim in the disclosure.

What are the next steps?

The next steps are mandatory credential resets for all users, an IP allowlist requirement for customers, and a phased restoration of services. Impacted accounts have been locked. All users must reset passwords and rotate API keys. Before access is restored, customers must submit their trusted IP addresses to an allowlist by writing to support@chainalysis.com. KYT and Address Screening are being restored in phases as of Nov 6, while Reactor and Data Solutions stay offline until hardening is complete. Chainalysis has engaged external security experts to support the response. The company has not named an attribution for the attack, noting only that the pattern matches recent attacks on other technology firms, including Chainstack, OpenCode, Warp and WorkOS.

By the numbers

Source snapshot