Chainalysis - From "Non-Sensitive" to "All Users": How a Breach Notice Changed in Five Days

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Chainalysis disclosed on 30 October 2026 that an external actor using "offensive agentic techniques" accessed systems and internal tools; the company initially described the data as non-sensitive and said no passwords or tokens were accessed. On 2 November it took Reactor and Data Solutions offline.

On 4 November (Eastern time) it reported an "on-path attack" exposing a subset of customer passwords, then at 11pm that password hashes and live tokens for all users were exposed, plus names and usernames. It reported no evidence that investigations data was accessed. From 6 November KYT and address screening were restored in phases; users must reset passwords and rotate API keys.

Not disclosed: number affected, initial access method, dwell time, attacker. Lessons: scope before reassuring, treat role-labelled staff lists as phishing fuel, rotate tokens and keys, and plan for vendor outages.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: Chainalysis security incident notice (updated 6 Nov 2026); BleepingComputer; TechRadar; Cointelegraph; The Block.