SafetyRisk, alignment & guardrails
Chainalysis says attacker stole credentials and live tokens for all of its users
Chainalysis, whose customers include the FBI, Microsoft and Coinbase, now says an attacker obtained names, usernames, password hashes and live tokens for every user. That reverses its October 30 assessment. Several services went offline, and customers must rotate their credentials.
From the Ars Technica · AI article of November 6, 2026 and cited sources: The breach was larger than first reported. [1] [2] [6]
SOURCES[1] Chainalysis says hackers stole credentials and tokens for… arstechnica.com[2] Chainalysis: Security incident updates (company statement) chainalysis.com[6] BleepingComputer: Chainalysis says breach exposed… bleepingcomputer.com
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- Original source
- Ars Technica · AI article, independent perspective
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- November 6, 2026 article published
- Covered
- Nov 7 edition
- Evidence
- 8 sources across 5 sites
- 1Chainalysis says hackers stole credentials and tokens for…arstechnica.com
- 2Chainalysis: Security incident updates (company statement)chainalysis.com
- 3Cointelegraph: Blockchain investigator Chainalysis hit by…cointelegraph.com
- 4BleepingComputer: WorkOS says attacker used ARTEX AI to…bleepingcomputer.com
- 5crypto.news: Chainalysis confirms user credentials…crypto.news
- 6BleepingComputer: Chainalysis says breach exposed…bleepingcomputer.com
QuietHow it’s measured
Hacker News · 5 likes
Reach blends public engagement (views, likes, comments, shares, stars) from the platforms where the story or its original source lives: YouTube, Hacker News, GitHub, Substack and similar. A video and the article written from its transcript share one score, taken from the video. Platforms with no data are left out rather than counted as zero, and the age of a story never lowers its score.
The breach was larger than first reported. On October 30, Chainalysis said it saw no sign that credentials or session tokens had been accessed. By November 4 it confirmed that every user's names, usernames, password hashes and live tokens were exposed. An on-path interception also captured some plaintext passwords. [1] [2] [6]
The login page, KYT, Address Screening, Reactor and Data Solutions were all taken offline. From November 6, KYT and Address Screening started coming back, but only for customers on IP allowlists. Password resets and API-key rotation are required before access. [2] [5] [6]
Chainalysis says the intruder used 'offensive agentic techniques' but has not named a tool. Around the same time, WorkOS and ConnectWise linked their own breaches to ARTEX, an autonomous AI penetration-testing framework. Reporting has tied ARTEX to attacks on more than 200 organizations. It has not been shown that ARTEX was used against Chainalysis. [4] [7] [8]
a live token can get around passwords and MFA until it is revoked, and the affected users include government investigators.
Read the full assessment
Implication: customers face session hijacking and targeted phishing, and compliance teams that rely on KYT need backup screening during outages.
Sources are checked; now writing the dossier.
Executive brief
Chainalysis is a blockchain-analysis firm whose customers include the FBI, ICE, the US Air Force, Microsoft, Coinbase and Barclays. It now says an attacker obtained names, usernames, password hashes and live tokens for every one of its users (Ars Technica). Its first notice, on October 30, said only "non-sensitive" data was reached and that there was no sign credentials or session tokens had been accessed. The company says the intruder used "offensive agentic techniques," meaning AI-agent-assisted attack tools, but has not described them. Chainalysis says it has no evidence that investigation data was accessed or that its attribution data was altered.
What changed and event timeline
First disclosure
Chainalysis said user IDs, names, emails and role labels were accessed by an attacker using "offensive agentic techniques." It said it found no evidence that credentials or session tokens were reached.
WorkOS reports a similar breach the same day
WorkOS found unauthorized access to an internal sales app and linked it to ARTEX, an autonomous AI penetration-testing framework.
Full exposure found internally
A Monday investigation found that credentials and tokens for all users had been exposed. Reactor and Data Solutions went offline for security checks.
More detail
Disclosure in stages
A 9:50 a.m. update said an on-path attack exposed some passwords. At 10:30 a.m. the login page, KYT and Address Screening were taken down. At 11:00 p.m. the company confirmed exposure for all users.
Phased restoration
KYT and Address Screening began coming back for customers on IP allowlists. Password resets and API-key rotation are mandatory.
Capabilities and access
- Data exposed: names, usernames, password hashes and live tokens for all users. A subset of plaintext passwords was intercepted in the on-path attack.
- Services affected: the login page, KYT (UI and API), Address Screening, Reactor and Data Solutions all went offline.
- Attacker tooling: no AI model, framework or version has been named. The reviewed sources do not confirm that ARTEX was used against Chainalysis (BleepingComputer).
Read the full section
- Data exposed: names, usernames, password hashes and live tokens for all users. A subset of plaintext passwords was intercepted in the on-path attack. (Chainalysis)
- Services affected: the login page, KYT (UI and API), Address Screening, Reactor and Data Solutions all went offline. Only KYT and Address Screening are being restored so far. (crypto.news)
- Attacker tooling: no AI model, framework or version has been named. The reviewed sources do not confirm that ARTEX was used against Chainalysis (BleepingComputer).
Technical analysis for researchers and developers
- On-path (adversary-in-the-middle) interception: Chainalysis has not said where in its infrastructure this happened, or whether the traffic was TLS-encrypted.
- Live tokens matter more than hashes: a valid token can let an attacker skip passwords and MFA until it is revoked.
- Containment pattern: services are returning only to IP-allowlisted customers, and credential rotation is required before access.
Read the full section
- On-path (adversary-in-the-middle) interception: Chainalysis has not said where in its infrastructure this happened, or whether the traffic was TLS-encrypted. Seeing plaintext passwords suggests the attacker could decrypt traffic or sat at a point where it was already decrypted. That would mean deeper infrastructure access, but this is an inference (Ars Technica).
- Live tokens matter more than hashes: a valid token can let an attacker skip passwords and MFA until it is revoked. Hashes need offline cracking, and Chainalysis has not named its hashing algorithm (crypto.news).
- Containment pattern: services are returning only to IP-allowlisted customers, and credential rotation is required before access.
Claims and evidence
- All users' credentials and tokens exposed: the company admits this, which makes it strong evidence (Chainalysis).
- No investigation data accessed and no attribution data altered: this comes from Chainalysis alone, and no independent forensic report has been published.
- AI-agent-assisted intrusion: this is Chainalysis's own description, with no technical detail. Independent confirmation is not available.
Read the full section
- All users' credentials and tokens exposed: the company admits this, which makes it strong evidence (Chainalysis).
- No investigation data accessed and no attribution data altered: this comes from Chainalysis alone, and no independent forensic report has been published. Its October 30 statement that credentials were not accessed was later reversed, so these assurances should be read cautiously (BleepingComputer).
- AI-agent-assisted intrusion: this is Chainalysis's own description, with no technical detail. Independent confirmation is not available.
Context and prior work
- In October 2026, WorkOS and ConnectWise reported intrusions linked to ARTEX (BleepingComputer).
- A Chinese developer published ARTEX on GitHub in July 2026 and made it closed-source on October 8, after more than 12,000 forks, according to Wiz research as summarized in reporting.
- Chainalysis had recently published research saying North Korea-linked hacks made up 89% of reported crypto-hack losses in 2026 (Cointelegraph).
Read the full section
- In October 2026, WorkOS and ConnectWise reported intrusions linked to ARTEX (BleepingComputer).
- A Chinese developer published ARTEX on GitHub in July 2026 and made it closed-source on October 8, after more than 12,000 forks, according to Wiz research as summarized in reporting. It has been tied to attacks on more than 200 organizations (search summary of WorkOS/ARTEX coverage).
- Chainalysis had recently published research saying North Korea-linked hacks made up 89% of reported crypto-hack losses in 2026 (Cointelegraph).
Limitations, safety and contested findings
- Contradiction: the October 30 statement found no evidence of credential or token access. The November 4 update confirmed both for all users (Chainalysis).
- Disclosure lag: full exposure was found on Monday but disclosed on Wednesday, and Chainalysis has not explained the gap (Ars Technica).
- "Non-sensitive" label: Ars questioned calling user data from government and law-enforcement customers non-sensitive.
Read the full section
- Contradiction: the October 30 statement found no evidence of credential or token access. The November 4 update confirmed both for all users (Chainalysis).
- Disclosure lag: full exposure was found on Monday but disclosed on Wednesday, and Chainalysis has not explained the gap (Ars Technica).
- "Non-sensitive" label: Ars questioned calling user data from government and law-enforcement customers non-sensitive.
- Date discrepancy: crypto.news puts the start of restoration at November 5, while the Chainalysis blog says November 6.
Business and practitioner implications
- Chainalysis customers: rotate credentials and API keys, revoke sessions, and watch for phishing that uses the leaked names, emails and role labels.
- Compliance teams: losing KYT means transaction screening has to fall back to other controls.
- Security teams: agentic attack tooling is now showing up in breach disclosures from several vendors.
Read the full section
- Chainalysis customers: rotate credentials and API keys, revoke sessions, and watch for phishing that uses the leaked names, emails and role labels. Investigators' identities are now exposed, which raises the risk of targeted social engineering.
- Compliance teams: losing KYT means transaction screening has to fall back to other controls. Plan for vendor outages.
- Security teams: agentic attack tooling is now showing up in breach disclosures from several vendors. Short-lived tokens, segmented internal tools and end-to-end encryption inside your own network reduce the damage from on-path interception.
The source trail.
Sources (8)
Chainalysis says hackers stole credentials and tokens for all of its customers
Article text retrieved; extracted text may omit tables or interactive elements.
arstechnica.com