Chainalysis shuts down services after user credential exposure

Blockchain analysis firm Chainalysis has taken key services offline after an ongoing agentic cyberattack exposed names, usernames, password hashes and live tokens for all users. Access to Reactor and Data Solutions was removed while the company investigated, and the Know Your Transaction (KYT) user interface and API, Address Screening products, and the login page were also taken offline.

Chainalysis said it has no evidence that investigation data was accessed or that its attribution data was manipulated. The company described the incident as an ongoing multi-front cyberattack and said it had addressed the attack vector. An earlier assessment had identified an on-path attack that exposed a subset of customer passwords.

Service recovery will require new credentials

The company has locked impacted accounts and deployed additional monitoring intended to identify unusual activity. Customers who received a password-reset notification cannot complete that reset yet because the relevant access remains unavailable. Chainalysis nevertheless advised customers to change passwords on other systems where they may have reused the same credentials.

For the staged restoration of KYT and Address Screening, Chainalysis asked customers to submit trusted IP addresses through its support channel or their account team. Those addresses will be added to an allowlist, after which users can reset passwords and rotate API keys to register transactions.

Chainalysis said every user will have to reset passwords and rotate API keys as appropriate before normal account access resumes. It is also working to harden its systems before bringing Reactor and Data Solutions back online. The organization has not identified the party responsible for the intrusion, but said the activity resembled attacks against other technology platforms in recent weeks.

Agentic attacks raise the pace of credential abuse

The incident emerged amid disclosures involving Chainstack, OpenCode, Warp and WorkOS, which have reported AI-driven attacks. Microsoft has described a campaign in which threat actors used an agentic offensive framework to find exposed secrets in public GitHub repositories, including credentials, application credentials and AI inference API keys.

Microsoft said agentic tooling such as ARTEX can scan repositories more quickly, analyse results and conduct follow-on actions with less hands-on-keyboard involvement. In one reported case, an AI agent moved from GitHub secret scanning to Azure Key Vault data exfiltration within five minutes. Microsoft assessed related activity as ongoing from August 2026.

The reported post-exploitation activity included misuse of valid application credentials to sign in to Microsoft Entra ID tenants and reach connected Azure and Microsoft 365 resources. Microsoft observed attempts to retrieve storage account keys, connection strings, publishing credentials, AI and machine-learning connections, datastores and Azure Kubernetes Service user credentials. Compromised applications then accessed SharePoint and OneDrive, including file downloads and mailbox-item access.

For businesses using Chainalysis or similar platforms, the practical response is to inventory credential reuse, plan password and API-key rotation, restrict access through trusted IP controls where offered, and watch for abnormal activity while affected services are restored.