Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services

Chainalysis discovered that its investigation into an agentic cyber attack had revealed sensitive user information inside its systems. The exposed data included names, usernames, password hashes, and live tokens. The company said it still had no evidence that investigation data was accessed or attribution data was manipulated.

As a precaution, Chainalysis removed access to Reactor and Data Solutions. It also took the Know Your Transaction interface and API offline, along with Address Screening, other address-screening products, and the login page. Impacted accounts were locked while the company investigated and added monitoring.

Chainalysis planned to begin restoring KYT and Address Screening access. Customers would need to provide trusted IP addresses, reset passwords, and rotate API keys. Reactor and Data Solutions remained offline while the company worked to harden systems and add protections.

An on-path attack occurs when an attacker positions themselves between a user and the service they are accessing. The attacker may then observe, relay, or alter communications instead of allowing the connection to remain private. This can expose information being sent during login or normal service use.

For example, if a user submits a password, the attacker may capture it if the connection or service is compromised. The same method can expose session details, credentials, or tokens that prove a user is already authenticated. The attacker can pass traffic onward, making the activity harder to notice.

Chainalysis said it discovered an on-path attack that exposed a subset of customer passwords and that the attack vector had been addressed. The company later reported broader exposure of names, usernames, password hashes, and live tokens during its investigation.

The reported scope was broad: Chainalysis said its investigation exposed names, usernames, password hashes, and live tokens for all users. That is more extensive than the earlier disclosure about a subset of customer passwords. The article does not provide a numerical count of users or say that every account was actively misused.

Password hashes are stored representations of passwords rather than ordinary readable passwords. Live tokens are active credentials that can represent an already authenticated user or service. Together, these data types can create different risks, depending on how they were obtained, protected, and whether they remain valid.

Chainalysis said it had no evidence that investigation data had been accessed or attribution data manipulated. It removed access to several products, locked impacted accounts, and added monitoring. Customers were told to reset passwords elsewhere if they reused Chainalysis credentials.

When accounts are locked, customers cannot use those accounts until Chainalysis verifies access and restores them. Taking interfaces and products offline can pause investigations, address screening, and automated connections that depend on Chainalysis services. It also prevents customers from completing ordinary password resets through the affected login system.

Chainalysis said customers should provide trusted IP addresses to its support team or account team. Those addresses would be added to an allowlist. Customers could then reset passwords and rotate API keys to register transactions. The company also urged users to reset reused passwords on other systems.

The disruption is both a security measure and an operational problem. Chainalysis intended to restore KYT and Address Screening first, while Reactor and Data Solutions remained under repair. It said every user would need additional protections, including password resets and API-key rotation as appropriate.

Reused passwords are dangerous because one stolen password may work on several unrelated services. Password hashes are not normally the original passwords, but attackers can try to guess them and compare results. Weak or reused passwords are especially valuable targets because the same guess may unlock multiple accounts.

Live tokens and API keys can be even more immediately useful. They may act as proof that a user or application is already authorized, allowing access without entering a password again. Depending on permissions, a key or token could reach data, cloud resources, transactions, or connected tools. Its risk depends on scope, expiry, and whether it has been revoked.

The Chainalysis response reflects these risks. The company locked impacted accounts and required password resets and API-key rotation. It also warned customers to reset reused credentials on other systems, even while Chainalysis password resets were unavailable.

Agentic AI changes attacks by connecting discovery and exploitation into a faster workflow. Instead of merely finding a secret, an AI agent can examine what it found, decide what it enables, and attempt the next actions. This reduces the attacker’s need to guide every step manually.

Microsoft described agents scanning public GitHub repositories for credentials, application secrets, and AI-related API keys. In one case, an agent moved from finding secrets to exfiltrating Azure Key Vault data in five minutes. Other activity involved service-principal sign-ins, credential-returning operations, and access to SharePoint and OneDrive.

The campaign was assessed as ongoing from August 2026. Agents also enumerated cloud resources through a compromised single-tenant OAuth application and targeted Azure AI services. The pattern suggests that exposed secrets can become starting points for broader, automated cloud attacks across connected applications and services.

Credentials are information used to establish identity, such as a username and password or an application credential. Authentication tokens are pieces of data issued after authentication that can represent an approved session or authorization. API keys are credentials designed for software to identify itself when calling an application interface.

These mechanisms let applications and services decide whether to permit an action. A token may authorize a current session. An API key may let software submit requests, register transactions, or use a service. Cloud credentials can open resources such as storage, databases, mail, or AI services, depending on their permissions and limits.

The article shows why this matters. Microsoft reported attackers using exposed secrets and valid application credentials to sign into Entra ID tenants and connected Azure and Microsoft 365 resources. They targeted storage keys, connection strings, machine-learning connections, AI services, and other credentials.