# Chainalysis now says password hashes and live tokens for all users were exposed

Source: https://startwithidentity.com/blog/2026-11-04-chainalysis-now-says-password-hashes-and-live-tokens-for-all-users-were-exposed/
Last updated: 2026-11-04
License: content by Start with Identity. Cite the source URL.

---

Chainalysis said late on November 4 that customer names, usernames, password hashes and live tokens for all users had been exposed to a malicious actor, reversing its October 30 statement that it had no evidence session tokens were accessed. The blockchain analysis firm first disclosed that an external actor using "offensive agentic techniques" had reached its systems and internal tools, exposing user IDs, names, email addresses and organization role labels. On November 2 it took its Reactor and Data Solutions products offline. On November 4 it said an "on-path attack" had exposed a subset of customer passwords and locked those users out, then took its KYT and address screening products and login page offline after detecting abnormal activity. It is notifying customers whose KYT accounts were accessed, and says it found no evidence that investigations data was accessed or attribution data manipulated.

## Why it matters

The live tokens matter more than the hashes. A valid session or API token works without the password or the second factor, so turning on two-factor authentication now does not stop a token already stolen; that is why Chainalysis will require every user to reset passwords and rotate API keys when access returns. The disclosure moved in five days from "no session tokens" to all users' tokens, a reminder that first statements describe what has been checked, not what happened.

If you use Chainalysis, send your trusted IP addresses for its allowlist, reset passwords through the official login page rather than emailed links, rotate API keys, and change any reused password elsewhere. The technique page is [token replay](https://startwithidentity.com/techniques/token-replay-unbound-endpoint/), and [device-bound session credentials](https://startwithidentity.com/glossary/device-bound-session-credentials/) are the control that makes stolen sessions hard to reuse. [WorkOS](https://startwithidentity.com/blog/2026-11-02-workos-says-ai-assisted-attack-reached-internal-sales-tool-and-crm-data/) also reported AI-assisted attack tooling this week.

Source: [Chainalysis](https://www.chainalysis.com/blog/security-incident-october-30/)