# Chainalysis: intruder using 'offensive agentic techniques' exposed all users' password hashes and tokens

Source: https://www.bankingnewsai.com/ai-incidents/chainalysis-2026-agentic-intrusion-customer-credentials
Last updated: Nov 10, 2026

Chainalysis · AI used against the institution · severity 3 of 5

Chainalysis, whose tools banks and crypto exchanges use to screen crypto transactions, said on 30 October 2026 that it had detected an external actor using "offensive agentic techniques" to gain unauthorized access to its systems and internal tools that month, in what it called part of an industry-wide rise in AI-driven cyberattacks. It first said only user IDs, names, email addresses and role labels were accessed. On 4 November it said names, usernames, password hashes and live tokens for all users had been exposed, that an "on-path attack" had exposed some passwords, and that some customers' KYT transaction-monitoring accounts appeared to have been accessed without authorization. It took KYT, Reactor and other products offline and restored them between 6 and 10 November with mandatory password resets. American Banker noted the company did not specify that AI drove this intrusion.

## Key facts

|  |  |
| --- | --- |
| Date | Oct 2026 (disclosed Oct 30, 2026) |
| Institution | Chainalysis |
| Country | Several countries |
| AI system | Attacker-side 'offensive agentic techniques', in Chainalysis's words; the company has not described the tooling |
| AI? | Described as AI by the institution or regulator — The institution, a regulator or a court called the system AI. |
| Category | Other (AI used against the institution) |
| Status | Confirmed by the institution |
| Severity | 3 of 5 — Material harm at a crypto-compliance provider used by banks: names, usernames, password hashes and live tokens for all users exposed, some transaction-monitoring accounts apparently accessed, and screening products offline for days; no financial loss or regulatory action has been reported. |

## What happened?

On 30 October 2026 Chainalysis published the text of an email to affected customers. It said that during October it had detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools, and that it was seeing an industry-wide rise in AI-driven cyberattacks. The company said some customer data it described as non-sensitive (user IDs, full names, email addresses and organization role labels) had been accessed, and that it had found no evidence of access to investigation content, passwords in clear text, MFA secrets or session tokens. It said the incident was unrelated to the theft at Binance. [1][2][3]

The company did not define 'offensive agentic techniques' or share technical details. BleepingComputer wrote that it was unclear whether the attackers used an existing agentic offensive-security framework or custom AI agents. American Banker noted that 'agentic' typically refers to AI software that carries out multi-step tasks on its own, and that the email cited a rise in AI-driven attacks without specifying that AI drove this one. [2][4]

The disclosure widened over the following week. On 2 November Chainalysis took its Reactor investigations tool and Data Solutions offline while keeping its compliance monitoring products running. On 4 November it told some customers that an 'on-path attack' had exposed a subset of customer passwords, then took KYT (user interface and API), other address-screening products and its login page offline because of abnormal activity. That night it said it had discovered on Monday that names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor, and that it was notifying customers whose KYT accounts appeared to have been accessed without authorization. [1][4][5]

American Banker reported that banks and crypto companies use KYT to check whether money moving through their platforms is tied to theft, sanctions or money laundering, that Chainalysis claims more than 1,500 customers in 70 countries, and that the outage came while the industry was trying to stop the Binance thieves from cashing out. Chainalysis said it had no evidence that investigations data was accessed or its attribution data manipulated. A spokesperson did not say how many KYT accounts were accessed, American Banker reported. [1][4]

## Timeline

- Oct 2026 — Chainalysis detects an external actor using what it calls offensive agentic techniques to access its systems and internal tools. [1]
- Oct 30, 2026 — Chainalysis discloses the incident and says user IDs, names, email addresses and role labels were accessed. [1][2]
- Nov 2, 2026 — Reactor and Data Solutions are taken offline; the company later says it discovered that day that password hashes and live tokens for all users were exposed. [1][4]
- Nov 4, 2026 — Chainalysis reports an on-path attack that exposed some customer passwords, takes KYT, address screening and its login page offline, and says some KYT accounts appear to have been accessed without authorization. [1][5]
- Nov 6, 2026 — Phased restoration of KYT and Address Screening begins; Reactor follows on 7 November and Data Solutions on 10 November. [1]

## What was the impact?

- Customers: Names, usernames, password hashes and live tokens for all Chainalysis users were exposed, per the company; a subset of customer passwords was exposed in an on-path attack and some KYT accounts appear to have been accessed without authorization. The number of affected customers has not been disclosed.
- Other: KYT, Address Screening, Reactor and Data Solutions were offline for between two and eight days in early November 2026. [1][4][5]

## How did Chainalysis respond?

Chainalysis said it took a 'whole-of-company approach', engaged third-party cybersecurity experts and used large language models to support a broader review of its platform's security. It took products offline, required every user to reset passwords and rotate API keys before returning, and asked customers to submit trusted IP addresses for an allowlist. 'We take the security of your data seriously and regret that this incident occurred,' its customer email said. A spokesperson told American Banker the company was not sharing information beyond its blog post. [1][4]

## What was the outcome?

Products were restored in phases between 6 and 10 November 2026 with mandatory credential resets. Chainalysis says its investigation is continuing; it has not identified the attacker, the entry point or the number of customers affected, and no regulatory action has been reported. [1][5]

## FAQ

### Was the Chainalysis breach carried out with AI?

Chainalysis said it detected an external actor using "offensive agentic techniques" and cited an industry-wide rise in AI-driven cyberattacks, but it has not described the tooling. American Banker noted that the company's email did not specify that AI drove this particular intrusion.

### What customer data was exposed in the Chainalysis incident?

On 30 October 2026 the company said user IDs, full names, email addresses and role labels were accessed. On 4 November it said names, usernames, password hashes and live tokens for all Chainalysis users had been exposed, that an on-path attack exposed a subset of passwords, and that some KYT accounts appeared to have been accessed without authorization.

### Were banks affected by the Chainalysis breach?

No bank has been named as affected. American Banker reported that banks and crypto companies use Chainalysis's KYT tool to screen transactions and that the product was offline from 4 November 2026 until its phased restoration began on 6 November. Chainalysis says it has no evidence that investigations data was accessed.

## Sources

1. [Chainalysis Security Incident Information (first published 30 October 2026; updated through 10 November 2026)](https://www.chainalysis.com/blog/security-incident-october-30/) — Chainalysis, Oct 30, 2026 (official): "This month, Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools."
2. [Chainalysis discloses data breach from "offensive agentic techniques"](https://www.bleepingcomputer.com/news/security/chainalysis-discloses-data-breach-from-offensive-agentic-techniques/) — BleepingComputer, Oct 31, 2026 (security research): "Chainalysis has not shared technical details about the intrusion, including which vulnerabilities were exploited, which internal tools were accessed, or how long the attackers had access."
3. [Chainalysis Discloses Data Breach Following AI-Driven Cyberattack](https://www.securityweek.com/chainalysis-discloses-data-breach-following-ai-driven-cyberattack/) — SecurityWeek, Nov 2, 2026 (security research)
4. [Chainalysis discloses apparent breach of customers' accounts](https://www.americanbanker.com/news/chainalysis-discloses-apparent-breach-of-customers-accounts) — American Banker, Nov 5, 2026 (news): "The email cited "an industry-wide rise in AI-driven cyberattacks" but did not specify that AI drove this one."
5. [Chainalysis says hackers stole credentials and tokens for all of its customers](https://arstechnica.com/security/2026/11/chainalysis-says-hackers-stole-credentials-and-tokens-for-all-of-its-customers/) — Ars Technica, Nov 6, 2026 (security research)

## Related incidents

- [AI-agent-assisted intrusions breach Shinhan, KB Kookmin, Hana and 13 other Korean financial firms](https://www.bankingnewsai.com/ai-incidents/korean-banks-2026-artex-ai-agent-intrusions)
- [CyberCartel reportedly used Claude, Grok and Kimi agents to attack 400+ Latin American financial firms](https://www.bankingnewsai.com/ai-incidents/latin-american-banks-2026-cybercartel-ai-agent-attacks)
- [Breach of Salesloft's Drift AI chat agent exposes CRM data at Toast, GreenSky and Fenergo](https://www.bankingnewsai.com/ai-incidents/salesloft-drift-2025-fintech-crm-breaches)

All AI incidents at banks: https://www.bankingnewsai.com/ai-incidents

---

Canonical page: https://www.bankingnewsai.com/ai-incidents/chainalysis-2026-agentic-intrusion-customer-credentials
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — the register of AI incidents at banks: https://www.bankingnewsai.com/ai-incidents. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.