The short version
- Chainalysis breach: names, usernames, password hashes and live login tokens of all users were exposed, the firm said late on November 4, and some passwords leaked in plain text.
- Reactor, its tool for tracing stolen coins, has been offline since at least November 2, while about $3.35 billion of the Binance haul is still out of reach.
- Next: KYT and address screening began coming back in phases on Friday; Reactor stays offline until Chainalysis finishes hardening its systems.
“Names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor.” That is the line Chainalysis added to its security incident notice late on Wednesday, November 4.
A week earlier the same notice said something very different. On October 30, the Chainalysis breach was about user IDs, names and email addresses. No passwords. No session tokens.
Now it covers every user. And the company’s main investigation tool has been offline for days, right in the middle of the hunt for the Binance hack money.
Wu Blockchain summed up the jump:
Chainalysis: Names, Usernames, Password Hashes, and Valid Tokens of All Users Were Exposed; Some Plaintext Passwords Also Leaked
Blockchain analytics firm Chainalysis disclosed in an updated security incident notice that the names, usernames, password hashes, and valid
What Changed Since the First Notice
The story moved fast. Here is the run-down, straight from the Chainalysis notice:
- October 30: an outside attacker used “offensive agentic techniques”, AI agents doing the hacking, to get into internal systems. Only basic user details were taken, Chainalysis said, and it was “unrelated” to the Binance theft.
- November 2: Reactor, the tool investigators use to trace stolen coins, and Data Solutions were taken offline “out of an abundance of caution”. KYT, the transaction monitoring that exchanges use to screen deposits, stayed on.
- November 4, 14:50 UTC (9:50 a.m. in New York): an “on-path attack”, where the attacker sits between a user and the login page, exposed some customers’ passwords in plain text. Those accounts were locked.
- November 4, 15:30 UTC: after “abnormal activity”, KYT, address screening and the login page went offline too.
- November 5, 04:00 UTC (11:00 p.m. on November 4 in New York): the all-users line above. Chainalysis also said it is warning customers whose KYT accounts look like someone else logged in.
Chainalysis still says it has no evidence that investigation data was read or that its attribution data, the labels saying which wallet belongs to whom, was changed. That second part matters most. Exchanges and police lean on those labels every day.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
Why the Chainalysis Breach Matters for the Binance Hunt
Timing. Chainalysis is one of the firms following the $6.43 billion taken from Binance on October 29.
Elliptic counts $2.85 billion of it frozen or seized, the same figure Binance gave in its own report. About $3.35 billion still sits in wallets linked to the theft, mostly ETH and BTC. Elliptic says the attackers used about 12,000 wallets across 11 blockchains in the first three and a half days. One new wallet every 25 seconds.
On Thursday, Chainalysis told Bloomberg it had traced part of the haul into Chinese money-laundering networks, a route North Korea has used before.
INTEL: Binance hacker moves stolen funds through Chinese money laundering networks | Per Bloomberg
So the firm tracking the money is doing it while its own tracing tool is dark and every customer is resetting passwords. Not ideal.
SIDE TRAIL: Can Crypto Be Frozen? Who Froze $2.7B of the Binance Hack, and Why $2.4B Got Away
What Users Should Do Now
Most readers never log in to Chainalysis. Its customers are exchanges and police forces, so the Chainalysis hack won’t touch most wallets directly. The lessons from this Chainalysis breach work for anyone with a crypto account, though.
- Don’t click reset links in emails. Chainalysis itself tells users to go straight to the login page. Fake reset emails are the obvious next move for an attacker.
- Change reused passwords. If a password from a leaked account works anywhere else, change it there today.
- Turn on two-factor authentication. An app or a hardware key, not SMS.
Our guide to protecting your crypto accounts walks through all three.
On Friday at 08:30 UTC (3:30 a.m. in New York), Chainalysis said it had begun bringing KYT and address screening back in phases, with more customers getting access over the following hours. Every user has to reset passwords and rotate API keys first.
Reactor stays dark until the systems are hardened. For a firm whose job is following stolen crypto, one line in the notice counts more than the rest: “no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated.”
TRAIL MAP: Binance Hack Report: A Fake Job Interview Opened the Door
TheCryptoMonk has been trading since 2017 and reads the market from the top down. The focus is macro and the high timeframes: where stocks, rates and liquidity are heading, and what the weekly and monthly charts say about Bitcoin. Short-term noise matters less than the bigger trend.
More from TheCryptoMonk
