Chainalysis says an AI-driven attack exposed names, usernames, password hashes and live tokens for every user, and key services are offline.
Chainalysis, a company that analyzes cryptocurrency transactions, says hackers got login details for all of its users. The exposed data includes names, usernames, scrambled versions of passwords and live access tokens. The company has taken several products offline while it investigates.
Chainalysis said less than a week ago that an outside group used AI-driven attack methods to get into its systems and internal tools. It first reported that a subset of customer passwords had been exposed through an "on-path attack," meaning someone positioned themselves in the path of data as it traveled. The company now says the exposure covers all users. It says the way in has been closed.
To contain the damage, Chainalysis removed access to its Reactor and Data Solutions products. It also took the Know Your Transaction (KYT) interface and API, other address screening products and the login page offline. It locked the affected accounts as a precaution.
A password hash is a scrambled form of a password. It is harder to use than the real thing, but it is not harmless. A live token works like a digital pass that proves who you are, so it is worth treating as sensitive. Names and usernames also help criminals write convincing phishing emails. The biggest everyday risk is password reuse. If your Chainalysis password also unlocks another account, that account is now a target.
People who have never used Chainalysis are not affected by this breach. Customers are, whatever their role or account size. There is one piece of reassurance. Chainalysis says it still has no evidence that any investigations data was accessed or that its attribution data was manipulated. Attribution data is the information it uses to link crypto addresses to real-world entities.
The alert box above lists the steps. In short, change any reused passwords elsewhere, and do not expect a Chainalysis password reset to work yet. Be careful with emails that claim to be from Chainalysis, especially any that ask you to click a link and log in.
Chainalysis says it plans to restore KYT and Address Screening first, for customers who send trusted IP addresses to be added to an allowlist. Reactor and Data Solutions will return later. When they do, every user will have to reset their password and rotate API keys, which means replacing the codes that let software connect to the service.
Who is behind the attack is unknown. Chainalysis says it looks like attacks on many other tech platforms in recent weeks. Chainstack, OpenCode, Warp and WorkOS have also reported AI-driven attacks, some involving a tool called ARTEX. Microsoft says attackers are using AI agents to hunt for exposed secrets in public code repositories, and in one case one went from scanning to stealing data in five minutes.
If you use Chainalysis, change any other account that shares its password now, and treat emails about this breach with suspicion.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone number
