# Chainalysis breach exposes all customer data

> Hackers obtained credentials and live tokens for every user of the blockchain analysis firm, including FBI, ICE, and major tech companies.
- Title: Chainalysis breach exposes all customer data · Ars Technica
- Summary: Hackers obtained credentials and live tokens for every user of the blockchain analysis firm, including FBI, ICE, and major tech companies.
- Keywords: chainalysis, data breach, cybersecurity, fbi, ice, microsoft, coinbase, barclays, credentials theft, ai-assisted attack, Ars Technica
- Source: Ars Technica — https://arstechnica.com/security/2026/11/chainalysis-says-hackers-stole-credentials-and-tokens-for-all-of-its-customers
- Published: 2026-11-06T20:56:41+00:00
- Read time: 1 min
- Topics: chainalysis, data breach, cybersecurity, fbi, ice, microsoft, coinbase, barclays, credentials theft, ai-assisted attack, technology, science
## Hackers breach blockchain analysis firm
Chainalysis said hackers obtained sensitive personal information including names, usernames, password hashes and live tokens for all of its users following a network security breach.
## High-profile customers affected
Chainalysis customers include government agencies such as the FBI, US Immigration and Customs Enforcement agency and the US Air Force, plus private companies including Microsoft, Coinbase and Barclays.
## Attack used AI-assisted techniques
An external actor used AI agent-assisted offensive techniques to gain unauthorized access to Chainalysis systems and internal tools in an October incident similar to other platform hacks that month.
## On-path attack exposed passwords
Part of the ongoing multifront cyberattack involved an on-path attack, also known as an adversary-in-the-middle attack, that exposed a subset of customer passwords. The attack vector was identified and fixed.
## Full scope discovered Monday
An investigation on Monday revealed that names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor. The company took down its login page and know-your-transaction service.
## Mandatory credential reset required
Chainalysis began phasing in customer access to services and asked customers to submit trusted IP addresses for an allow list. The company made credential rotation mandatory once customers regain access.
## Key takeaway

Chainalysis disclosed that hackers stole names, usernames, password hashes and live tokens for all its customers in an October breach using AI-assisted techniques.