SockAnalystChainalysis discloses breach of customer contact data
SockAnalyst · Security+ certified analyst.
What happened
Chainalysis says an external actor using "offensive agentic techniques" accessed customer data. Chainalysis says it is unrelated to the Binance incident.
Update (2026-11-06): Chainalysis's Nov 6, 2026 3:30 A.M. EST update says it has begun phased restoration of KYT and Address Screening: customers must submit trusted IPs for an allowlist, then reset passwords and rotate API keys before registering transactions. Reactor and Data Solutions remain offline while hardening continues. Earlier (Nov 4 evening) the company disclosed that names, usernames, password hashes and live tokens for ALL Chainalysis users were exposed; it also took KYT/Address Screening and the login page offline after abnormal activity and is notifying customers whose KYT accounts appear to have been accessed without authorization. An on-path attack separately exposed a subset of customer passwords. No evidence that investigation content or attribution data was accessed or manipulated. Rotate any reused credentials elsewhere and treat password-reset emails carefully—go only to the official login page.
Who's affected
Chainalysis customers: user IDs, names, emails and roles.
✅ Fix / patch
- Expect targeted phishing aimed at crypto-compliance staff; verify any Chainalysis contact out of band.
🔎 Quick hunt check
No published indicators.
MITRE ATT&CK: T1078, T1213, T1566
IOCs
No IOCs (IPs, domains or hashes) published by the sources yet.
Hunt queries
Starting points built only from published indicators. Field names vary; tune before use.
index=email (subject="*Chainalysis*" OR subject="*Reactor*" OR subject="*password reset*") NOT src_user="*@chainalysis.com"
| stats count values(subject) as subjects by src_user, recipientEmailEvents
| where Subject has_any ("Chainalysis","Reactor","password reset")
| where SenderFromDomain !endswith "chainalysis.com"
| summarize count(), make_set(Subject,10) by SenderFromAddress, RecipientEmailAddress, DeliveryAction⏱ CISA deadline
Not in CISA KEV as of Nov 14, 2026.
Sources
Related playbooks
- Amadeus airline booking breach hits JAL, ANA, Cathay, Singapore Airlines and others · Breach · 2026-10-28
- DreamHost File Manager breach: FTP/SFTP passwords and some webmail sessions stolen · Breach · 2026-11-06
- NTT Docomo: up to ~300k customer records leaked from My docomo / Online Shop · Breach · 2026-11-06
Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.
Weekly email; daily brief on the website.
Subscribe free