The exact text we saved

This is the version exactly as it was saved, character for character. The SHA-256 hash below is a 64-character code worked out from that text. Run the same text through SHA-256 and you get the same code; change a single letter and the code comes out completely different. Each version also stores the previous version’s hash, which chains them together so no version can be swapped out quietly.

TRUVACE RECORD VERSION
record: TRV-2026-2869
version: 1
kind: certified
reason: Certified into the record
timestamp: 2026-11-12T18:03:05.333929Z
status: published
lens: p_space
sector: crime
headline: Chainalysis Security Incident Information
dek: Chainalysis was recently the target of a cybersecurity incident, similar to many other tech platforms in recent weeks. Based on the investigation to date, we have found no evidence of unauthorized access to investigation content, authentica…
gain_title: (none)
problem_title: In a breach Chainalysis disclosed on 30 October 2026, an external actor using offensive agentic techniques accessed internal systems; by 4 November names, usernames, password hashes and live tokens for all users were exposed, and products were pulled offline for days.
trace_subject: (none)
gain_reading: (none)
gain_evidence: (none)
problem_reading: In a breach Chainalysis disclosed on 30 October 2026, an external actor using offensive agentic techniques accessed internal systems; by 4 November names, usernames, password hashes and live tokens for all users were exposed, and products were pulled offline for days.
problem_evidence: Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools | names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor
quick_read: Blockchain analytics firm Chainalysis said an external actor using offensive agentic techniques broke into its systems and internal tools. The company first reported the incident on 30 October 2026, saying only non-sensitive data such as user IDs, full names, email addresses and organization role labels had been accessed.

The picture worsened over the following days. On 4 November the company said names, usernames, password hashes and live tokens for all users had been exposed. It took Reactor and Data Solutions offline, then pulled KYT and Address Screening after abnormal activity. Those are tools customers use to monitor transactions and detect money laundering.

Access came back in stages: KYT and Address Screening from 6 November, Reactor and the KYT interface and API on 7 November, and Data Solutions on 10 November. Chainalysis said it found no evidence that investigations data was accessed or that its attribution data was manipulated.
limitation: Chainalysis's account is a company statement of what its own investigation had found to date, and its early assurances on exposed data were later widened, so the full extent of the breach is not independently verified.
tag: Evidence-backed problem
key_points: Chainalysis's 30 October email to customers said an external actor used offensive agentic techniques to gain unauthorized access to its systems and internal tools. | The initial notice said user IDs, full names, email addresses and organization role labels were accessed, but not clear-text passwords, MFA secrets or session tokens. | On 4 November Chainalysis said names, usernames, password hashes and live tokens for all users were exposed, a wider scope than first reported. | Chainalysis said an 'on-path attack' exposed a subset of customer passwords, and it locked those accounts and required password resets. | Reactor and Data Solutions were taken offline first; KYT, its user interface and API, and Address Screening followed on 4 November after abnormal activity. | On restoration, every user had to reset passwords and rotate API keys, and customers were asked to submit trusted IP addresses for an allowlist. | Chainalysis said the incident was unrelated to the recent crypto theft at Binance and that it was using large language models to help review its platform's security.
rundown: Chainalysis first described the breach on 30 October 2026 as similar to incidents at many other tech platforms in recent weeks. It said the actor used offensive agentic techniques and that it was working with outside cybersecurity experts to patch vulnerabilities and harden its systems. It said it was seeing an industry-wide rise in AI-driven cyberattacks.

On 2 November it took Reactor and Data Solutions offline as a precaution but kept its compliance transaction monitoring products running, citing their role in detecting money laundering. On 4 November it said it had discovered on Monday that customer names, usernames, password hashes and live tokens for all users were exposed.

Later on 4 November, abnormal activity led Chainalysis to take KYT, its user interface and API, offline along with other address screening products and the login page. It said it was directly notifying customers whose KYT accounts appeared to have been accessed without authorization.

Restoration ran from 6 to 10 November. KYT and Address Screening returned first in phases, then Reactor and KYT on 7 November with enhanced security measures, and Data Solutions on 10 November. Customers were told to reconnect in a specific way and follow emailed instructions.
sources:
- journalism | Chainalysis | https://www.chainalysis.com/blog/security-incident-october-30/ | 2026-10-30
prev: 0000000000000000000000000000000000000000000000000000000000000000

SHA-256 hash

8bf59072e8dc5ad5659edeb66ea564dd83e29ca497e0328ef6c9e0f50d8d84bb

Previous version’s hash

0000000000000000000000000000000000000000000000000000000000000000