Chainalysis admits all user password hashes and live tokens leaked after initial denial
Current overview (not historical)
Chainalysis has acknowledged that its October cyberattack exposed all users' names, usernames, password hashes, and live tokens, and said it contained the man-in-the-middle attack vector, locked affected accounts, and required password resets. The company initially said on October 30 that the intrusion exposed only user IDs, names, and email addresses, with no evidence that attackers accessed authentication credentials or session tokens. Its latest statement reverses that position by admitting password hashes and live tokens were also obtained by malicious actors.
Written with AI from the reporting · updated 11/6/2026
Expand the detailed fact route and sources
Story route
A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.
- 1Unclassified fact stationNov 6, 00:00recorded Nov 6, 15:21single sourcerevised
Chainalysis 泄露事件扩大，涉及密码哈希和实时令牌
Read original source ↗ CointelegraphReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- Chainalysis
- Action：
- 披露所有用户的密码哈希和实时令牌因网络攻击泄露
- Object：
- Chainalysis 所有用户账户信息
- Occurred (fact side)：
- Nov 6, 00:00
- Published (valid side)：
- Nov 6, 14:54
- First seen (known side)：
- Nov 6, 15:21
Fact stationSingle source · one-sided claimRevisedCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
Uncertainty marks flag where to check the sources; they are not proven causation.
Report timeline
Explore every side through dated source reports.
- CointelegraphSelectedRelated fact: single sourceSource report revisedChainalysis Confirms Password Hashes and Live Tokens Exposed in Cyberattack
Report first recorded Nov 6, 15:21
Blockchain analytics firm Chainalysis has updated its disclosure on a cyberattack, revealing that names, usernames, password hashes, and live tokens for all of its users were exposed to a malicious actor. Initially, the company reported on Oct. 30 that only non-sensitive customer data was accessed. The latest update attributes the password exposure to an 'on-path attack.' Chainalysis has contained the vulnerability, locked affected accounts, and mandated password resets, though it found no evidence that core investigation or attribution data was compromised.
Read original source ↗
Event activity trend
Not enough continuous observations to chart activity.
Event discussion
Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.